sys_properties can't edited

[caoh]

We found that the value of the table setting within the System Property has become uneditable.

Upon investigation, we found a Write‑type ACL added by the Build Agent (Trial) application on the System Property table with the following settings:
1) The Decision Type is set to **Deny Unless**.
2) The following Data Condition has been configured:
`sys_scope=6805ff49c0eb46ee969d42f0dd56b3bf`
※The sys‑id shown above belongs to the Build Agent (Trial) application.

Due to the above settings, all system‑property records other than those owned by the Build Agent (Trial) application have become unmodifiable.

[Brad Bowman · Accepted solution]

Delete that ACL, or modify it to check the 'Admin overrides' box after elevating your role to security admin.

[Brad Bowman · Accepted solution]

Delete that ACL, or modify it to check the 'Admin overrides' box after elevating your role to security admin.

[IbrarA · Accepted solution]

Hi @caoh, 

You can deactivate that ACL instead of deleting it, since it belongs to Build Agent (Trial) and keeping the record makes it easier to reverse and to report back to the app vendor. For reference on why nothing else can restore access once a Deny-Unless fails:
https://www.servicenow.com/docs/r/platform-security/access-control/acl-denial-behavior.html

thanks

[caoh]

Thank you very much for your response.

The ServiceNow instance operated by our company is shared by several teams rather than reserved exclusively for our team. For this reason, direct modification of the target ACL cannot be performed from our side.

Upon checking the Build Agent (Trial) application, the currently installed version is 2.4.5.  According to its release‑note documentation, the latest release 2.4.8 includes the fix “sys_properties can be edited again”. Upgrading the application to 2.4.8 is therefore expected to resolve the incident.