When logged in as an Admin, I can't see any users listed under and unfiltered view of User Administration>Users.

ewilks · ‎01-03-2017

However, when I impersonate a user with the same roles, I can see all of the users. Any idea what the problem could be?

robpickering · ‎01-04-2017

I'd review Chuck's suggestions. I honestly haven't seen people have Admin groups that contained a bunch of roles other than just "admin". You may be running into an issue whereby the roles are behaving strangely even though one of your roles is in fact "admin".

If it works correctly by only having "admin" in the group, then I'd just remove all of the other roles from your "ServiceNow Sys Admins" group, they aren't serving any purpose unless you have a bunch of custom ACLs in your environment.

In fact, it's possible that you have an ACL the prevents people with "issue_tracker" from seeing the Users table and that the ACL does NOT have "Admin Override" enabled, in which case it would block even admins...

-Rob

View solution in original post

robpickering · ‎01-03-2017

Eric,

Can you provide a little more information? Screenshots are always nice if there are no data privacy issues.

Sometimes I've seen role inheritance cause issues, the user who cannot see Users, are they in a group that is granting them the Admin role? If so, remove them from the group and re-add them, then try again.

-Rob

ewilks · ‎01-03-2017

Thanks Rob. I attempted what you suggested with removing the group (ServiceNow Sys Admins) from my login that begins with "a_" (the one I am having problems with. Strangely, this didn't remove the roles. So I manually removed them and added the user back to the (ServiceNow Sys Admins) group, but I still can't see any users.

Below I have attached screenshots of the roles for each of these users. The second screenshot is the one with which I am having the issues.

Thanks,

Eric

robpickering · ‎01-03-2017

Eric,

For starters, an "Admin" account with the "admin" role doesn't require any other roles. So your "ServiceNow Sys Admins" group should only have "admin" in it. Not sure that matters, it's more just an FYI.

That said, I'd be curious what happens if you remove the second user from your "ServiceNow Sys Admins" group and then manually grant the "admin" role directly to the user. Keep in mind that you must log out and log back in for role changes to be visible.

-Rob

ewilks · ‎01-04-2017

Thanks Rob,

I did remove that user from the ServiceNow Sys Admins group, and removed all roles that were assigned to it. Then I added back the admin role. Then I logged in with the a_ user. Perfect, I was able to see the users.

Then, since that user is part of the admin group, I added that user back to the group ServiceNow Sys Admins. At that point, I could no longer see any users.

After that, I started to remove roles from that user and when I removed the role "issue_tracker" (I know, I don't need it, but I'm curious like a cat), I was able to see all of the users. So I went back in to add issue_tracker (since I have a number of users with identical roles, which can see all of the users), and I could still see all the users. Not only that, this same user, with the exact same roles in TEST and DEV environments and they have no problem seeing the users.

Thanks for the help, Rob. I'll be at my desk, slamming my head in the drawer, since none of this makes any sense.