GROW

config

Schedule reports emailed to inactive user

This issue is found automatically by CODA.
Time to fix: 30min

What is a Scheduled Report?

In ServiceNow, a Scheduled Report is a type of report that is set up to execute automatically at predetermined times, eliminating the need for manual initiation. Users have the flexibility to arrange these reports to run on a daily, weekly, monthly basis, or at any other custom frequency. This functionality is especially beneficial for the automatic creation and distribution of reports, guaranteeing consistent delivery of pertinent information.

Why is this an issue?

Periodically, scheduled reports are sent to a list of selected users. These users receive an email from a pre-chosen user in the Scheduled Report, or the instance email if no users are selected.

It is possible that the user who is set to send those reports is inactive. This is a problem because the user may no longer be a member of the firm or a member of the delegated sector. This can lead to various issues, such as:

  • Exporting Unprotected Data: When a scheduled report runs, it retrieves and exports data without necessarily adhering to ACL restrictions, which means it may include information that should be restricted based on user roles and permissions.

  • Security and Governance Concerns: In a secure and well-governed environment, it is essential to monitor and control the flow of sensitive data. If numerous scheduled reports are active exporting data it can lead to potential data breaches and compliance violations.

How do I fix it?

  1. In the Filter Navigator, type and enter sysauto_report.list.

  2. On list view, click on the report that is being emailed to an inactive user.

  3. Under the User field, click on Unlock Users and remove the inactive user from the list.