Hello all,
I was trying to search for comments or posts around this plugin upgrade version (11.0.3) but it seems it did slipper somehow.
ServiceNow introduced the new role “GRC Business User” in the latest release (11.0.3) and added to all users in the system. Yes, there is no way to stop that to happen (I raised a hi ticket) but there is a KB article that explains the reason behind this change and helps you to rollback this change in case: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0864247
GRC Business Users
The Governance, Risk, and Compliance (GRC) product line requires action from many users who do not have a traditional product role, such as Compliance Reader or Risk Reader. Even the reader roles allow access to the product module, dashboard, reports, and read-only table access.
To improve the internal security of the product, we created a dedicated GRC Business User role. This role should be assigned to users who require access only to GRC applications in the context of performing tasks assigned to them; for example, a business user who needs to respond to an attestation or risk assessment. Users with the GRC Business User role are provided limited access to data and to information relevant to the tasks assigned to them.
The number of users assigned to the GRC Business User role does not impact product licensing. Product licensing is based on the number of users that perform GRC operations as opposed to the number of users with a role that allows access to GRC operations.
Important note: To keep the product behavior consistent on upgrade, we initially assign the GRC Business User role to all users in the sys_user table by adding them to the GRC Business Users group. We do this to match the previous product behavior that tasks such as attestations can be assigned to any internal employee. You can remove users from the GRC Business User role to restrict access for specific users.
I have improved ootb script to be more defensive and used an on demand schedule job to avoid to get the process hang during execution. That way the process would not be associated to an UI session and would run in the background without interruptions.
Please use below script to delete all users from GRC Business Users group :
Steps:
1. Create a fix script called “Remove GRC Business User to all users”
Application: GRC: Profile
Script:
var rec = new GlideRecord('sysauto_script');
rec.get('name', 'remove_users_to_grc_business_group');
gs.executeNow(rec);2. Create a Scheduled Execution Job (sysauto_script) called “remove_users_to_grc_business_group“
Application: GRC: Profile
Run as: Administrator
Run: On Demand
Script:
var grGroup = new GlideRecord('sys_user_group');
if (grGroup.get('053cd11a5bda50106d8012300a81c721')) // ensure the group exists and we do not skip the addQuery condition
{
var grMember = new GlideRecord('sys_user_grmember');
grMember.addQuery('group', '053cd11a5bda50106d8012300a81c721');
grMember.query();
gs.info("KB0864247 - There are " + grMember.getRowCount() + " members of the GRC Business Users group");
while(grMember.next())
{
gs.info("KB0864247 - We are deleting user: " + grMember.user.getDisplayValue() + " - from the group: " + grMember.group.getDisplayValue());
grMember.deleteRecord();
}
}3. Execute the fix script.
If you have any questions, please let me know! Happy GRCommanding
