Roles Not Removing from User

yana7 · ‎06-27-2024

I'm trying to remove roles from a user, but they're not being removed.

[Image 1] This is the user I want to remove roles from.
[Image 2] I've removed the roles in the Edit Role section and saved.
[Image 3] The roles are still listed in the Related list tab.

When I check the User tab from the Role itself, the user account is still there.

What should I do to Remove Roles?

SN_Learn · ‎06-30-2024

Please try the below in background script:

var userRole = new GlideRecord('sys_user_has_role');
userRole.get('61737f1bc36602103869d64d050131ee'); //Replace SysId of the role relationship in the [sys_user_has_role] table
userRole.inherited = false; //Updating it to false, then only we will be able to delete it.
userRole.update();
userRole.deleteRecord();

Highlighted sys_id is what you need to replace in the above code as per your requirement

Note: Please try in non prod first and check and it is not recommended to run background script in Prod.

Mark this as Helpful / Accept the Solution if this helps

----------------------------------------------------------------
Mark this as Helpful / Accept the Solution if this helps.

View solution in original post

zackss · ‎06-27-2024

Hello @yana7 ,

It seems that Dedy has a group, have you checked if that group is the one containing the role?

Regards,

Zack

yana7 · ‎06-30-2024

the group had no role

Dr Atul G- LNG · ‎06-28-2024

Hi @yana7

As per best practice, a role never assigned to a user directly , and in same line when you want to remove the role, remove the role from group first and then it will get removed from user profile.

*************************************************************************************************************
If my response proves useful, please indicate its helpfulness by selecting " Accept as Solution" and " Helpful." This action benefits both the community and me.

Regards
Dr. Atul G. - Learn N Grow Together
ServiceNow Techno - Functional Trainer
LinkedIn: https://www.linkedin.com/in/dratulgrover
YouTube: https://www.youtube.com/@LearnNGrowTogetherwithAtulG
Topmate: https://topmate.io/atul_grover_lng [ Connect for 1-1 Session]

****************************************************************************************************************

Bert_c1 · ‎06-29-2024

HI @yana7

If you have the "Contextual Security: Role Management V2" plugin activated (activated on instances for some time now). Then there is a fix script Servcenow Support can run to identify any inheritance errors, and correct that aspect. If you don't have that plugin, activate it.

If a role was added to a user directly (not best practice as stated above) then admin user should be able to delete the record. Once the sys_user_has_role table has been cleaned up, avoid adding roles directly (although still possible) and do that using groups. for sys_user_has_role records you can add the 'Inheritance map' column to a list view and see how that user inherited the role.

yana7 · ‎06-30-2024

This is the inheritance map for user Dedy's roles

his is the map for another user.