We've updated the ServiceNow Community Code of Conduct, adding guidelines around AI usage, professionalism, and content violations. Read more

Where would you go to see if an admin impersonated another user?

WITOU
Tera Contributor

Hi,

 

Could you, please, give me the correct answer  of the question below:

 

I'm confused between the second and the third answer.

 

Where would you go to see if an admin impersonated another user?

  • In the transaction logs and look for impersonation.start and impersonation.end in the name field
  • In the User Transaction logs
  • In the Event logs and look for impersonation.start and impersonation.end in the name field
  • In the Client transaction logs

Thanks for your help 🙂 

5 REPLIES 5

Dr Atul G- LNG
Tera Patron

Hi @WITOU 

 

Easy to find the right answer.

 

Login to PDI.

Impersonate In and Out.

 

Check at these places:

  • In the transaction logs and look for impersonation.start and impersonation.end in the name field
  • In the User Transaction logs
  • In the Event logs and look for impersonation.start and impersonation.end in the name field
  • In the Client transaction logs

And confirm which is right.

*************************************************************************************************************
Regards
Dr. Atul G. - Learn N Grow Together
ServiceNow Techno - Functional Trainer
LinkedIn: https://www.linkedin.com/in/dratulgrover
YouTube: https://www.youtube.com/@LearnNGrowTogetherwithAtulG
Topmate: https://topmate.io/dratulgrover [ Connect for 1-1 Session]

****************************************************************************************************************

Hi @Dr Atul G- LNG,

 

Thanks for your reply.

 

Could I understand from your reply that the correct answer is  " In the User Transaction logs"?

 

When I navigate to Navigate to System Logs >Events, I see events impersonation.start and impersonation.end events. Thats why I'm confused between the two answers.

 

Thank you in advance for your help,

WITOU
Tera Contributor

Hi @Dr Atul G- LNG,

 

Thanks for your reply.

 

Could I understand from your reply that the correct answer is  " In the User Transaction logs"?

 

When I navigate  to System Logs >Events, I see events impersonation.start and impersonation.end events. Thats why I'm confused between the two answers.


Thank you in advance for your help,

Yes. @WITOU 

*************************************************************************************************************
Regards
Dr. Atul G. - Learn N Grow Together
ServiceNow Techno - Functional Trainer
LinkedIn: https://www.linkedin.com/in/dratulgrover
YouTube: https://www.youtube.com/@LearnNGrowTogetherwithAtulG
Topmate: https://topmate.io/dratulgrover [ Connect for 1-1 Session]

****************************************************************************************************************