How to check who added a user to the group?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-19-2022 12:26 PM
I have enabled system property glide.ui.schedule_slushbucket_save_for_group_roles to grant roles and groups using background jobs instead of foreground job.
Now when we add a user to the group, on the group membership record, it shows created by and updated by as 'system'. Is there any other way to check who added the user to the group.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-19-2022 12:45 PM
Hi there,
When you have this sys_property enabled to grant roles and groups using background jobs, ServiceNow will create an event for sn_change_cab.group_member.added/removed depending on whether the user is being added or removed, with parm1 = sys_id of the user being added or removed, and parm2 = sys_id of the group that the user is being added to or removed from.
These events that are created will have the Created by = the user who actually requested for users to be added/removed from the group even though the group membership record will always have created by = system as you mentioned (note: I am logged in as system administrator which is why created by = admin for the below records):
If this answer is helpful please mark correct and helpful!
Regards,
Christopher Perry
Regards,
Chris Perry
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-20-2022 11:45 AM
Hi Christopher,
Thanks for your response.
I tried the same, but after enabling the property glide.ui.schedule_slushbucket_save_for_group_roles, in the event log it will show created by and updated by as 'system' for sn_change_cab.group_member.added/removed events.
Regards,
Nived K

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-22-2022 07:28 AM
Are you logged in as the system user? I just tested again and I am seeing the behavior I described above:
If this answer is helpful please mark correct and helpful!
Regards,
Christopher Perry
Regards,
Chris Perry