Where to check deleted ACLs? Is it even possible?

[Community Alums]

Hello Experts,

I'm trying to identify if particular ACL was deleted, but unfortunately, I cannot find a place that would store information about deleted ACLs. I tried to check sys_audit and sys_audit_delete, but no luck there. And this was not part of an Update Set.

Is it possible to verify what ACLs were deleted?

Best regards,
Lukasz

[vinothkumar]

You can check in the deleted records module in Service now. Add the filter condtion like payload contains your ACL contains sort of.

You will be able to find out if it has been deleted.

[Matthew Smith]

It doesn't look like the sys_security_acl table is audited by default so it won't appear in Deleted records. 

Another option might be to clone over a sub-prod instance from an old backup and check if the ACL was present.

Hope it helps.

Matt