Where would you go to see if an admin impersonated another user?

[WITOU]

Hi,

Could you, please, give me the correct answer  of the question below:

I'm confused between the second and the third answer.

Where would you go to see if an admin impersonated another user?

• In the transaction logs and look for impersonation.start and impersonation.end in the name field
• In the User Transaction logs
• In the Event logs and look for impersonation.start and impersonation.end in the name field
• In the Client transaction logs

Thanks for your help 🙂 

[Ankur Bawiskar]

@WITOU 

you should be able to find it in System logs

ServiceNow has a KB article published regarding this in detail

How to find the history of impersonations 

If my response helped please mark it correct and close the thread so that it benefits future readers.