Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
User Records are Being Updated by the "guest" User - Support and Troubleshooting
  • >
  • Knowledge Base
  • >
  • Support and Troubleshooting (Knowledge Base)
  • >
  • User Records are Being Updated by the "guest" User
KB0683874

User Records are Being Updated by the "guest" User


9685 Views Last updated : Sep 13, 2022 public Copy Permalink English (Original)
  • English (Original)
  • Japanese
KB Summary by Now Assist

Issue

The records in the sys_user table (user records) are being modified by the guest account, the Updated by field shows the "guest" user.

 

Cause

When performing certain automated tasks in which no user or process is logged in, the system will use the default name "guest", which is similar to the behavior seen when "system" is shown updating a record in the platform. The user accounts that have been updated by "guest" are accounts where users had failed login attempts or were locked out of the system. 

Resolution

You can confirm which fields the "guest" account has updated by reviewing either the sys_audit table of the history list from the record.

  1. On a user record where the Updated by field shows "guest"
  2. Right click in the header of the form History > List. This will show you the history list for your record, and show you in the Audit History section the fields that have been updated. 
  3. You will see the "Locked Out" field could have been updated by guest, or the "Failed Login Attempts" counter, as well as the "Password Reset" box and the "Locked Out Reason" field.

 

 You can also find this information directly from the sys_audit table.

  1. Copy the sys_id of an impacted user record and then navigate to the Audit table (sys_audit)
  2. Show matching where Table Name is sys_user
  3. Populate the Document Key field with the user record sys_id number
  4. Look where User is guest

This behavior is working as expected in our platform. 

Related Links

For user records that have been created by "guest" please see -- KB0683896 - User Records are being Created by the "guest" User


The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.