Issue with Instance Scan - Table Check for Inactive Users in sys_user

[UmamaheshC32034]

Hi ServiceNow Community,

I’m trying to create a Table Check under Instance Scan to identify inactive users in the sys_user table. Here’s what I did:

1. Created a new Table Check in Instance Scan.

2. Set the condition as:

   • Table: User (sys_user)

   • Condition: Active is false

3. Ran the check, but no findings were generated, even though there are inactive users in the sys_user table.

4. To verify, I created a similar check for Active is true, and it successfully found active users.

Has anyone faced a similar issue or know why the scan is not detecting inactive users?

Troubleshooting Done:

• Manually verified the sys_user table – confirmed inactive users exist.

• Checked if there are ACLs restricting access to inactive users.

• Ran Test Check, but still no findings.

• Tried using Active is NOT true instead of Active is false but no success.

Would appreciate any insights or suggestions!

Thanks in advance.

[Joe Walters]

Ran into this myself today, and wanted to mention there's an alternative, if you're okay with creating a Scan Check using 'Script Only Check' instead of 'Table Check'.

For instance, a script to check for inactive users can be as simple as the following:

(function(finding) {
    try {
        // Query User [sys_user] table for inactive users
        var userGr = new GlideRecord('sys_user');
        userGr.addInactiveQuery();
        userGr.query();
        while (userGr.next()) {
            finding.setCurrentSource(userGr);
            finding.increment();
        }
    } catch (e) {
        finding.increment();
    }
})(finding);

And then you just to paste that into a new 'Script Only Check' Scan Check record like below and add the Check to a Suite (or click 'Test Check' if you only want to quickly see the results).