How do we stop closed incidents being reopened by the user whlist allowing resolved incidents to be reopened?

[Rob C]

We found a comment on the service now documentation that says a user can't reopen a closed incident but can open a new incident which uses the closed incident as source (not sure what that means in practice), by replying to any email about their original incident and using the subject "please reopen". We tried this and instead of opening a new incident and referencing the closed incident (linking?) the original incident state was changed from closed to active.

Any help on what we need to change to prevent closed incidents being re-opened?

[Michael Fry1]

Make sure your inbound action is up to date and includes a call to the script includes: Incident

The script includes - Incident - actually calls IncidentSNC and if you look at the script, it's checking the State:

[Coleton]

The 'Update Incident' IA should be disabled and the 'Update Incident (BP)' should be enabled which handles the creation of a new ticket, based off the originally closed ticket.

[Michael Fry1]

That's how it comes out of the box. Update Incident (BP) is active and Update Incident is inactive.

[Coleton]

There's an Inbound Action called 'Update Incident (BP)' which handles the reopening of the ticket, that you're referring to. It utilizes a 'reopen()' function for an object of type Incident. You could add to that condition to add other keyword for creating new incidents which refer to the originally closed INC.

I believe if you check the 'stop processing' select box on this action, it will only reopen the ticket. If this isn't selected, the 'Create Incident' IA will also run as the order is the same OOTB.

So unless you have an IA which updates the state to 'Open' and 'Active' = True, the INC shouldn't reopen. You cannot modify the state field once it's closed, OOTB.