ServiceNow is our new ITSM system. To modify groups within ServiceNow, you need two sets of permissions:

• Active Directory modify
• Administrator (or a lesser but equivalent role) with the Service Now instance you need to modify

Technically, you can get away with JUST having Active Directory modify rights, if you're patient enough to let the scheduled job within ServiceNow suck the Active Directory changes into Service Now. Usually you want to immediately know whether your changes applied properly.

Overview of Procedure

• Modify assignment group to Active Directory in the ServiceNow OU:
  • type=distribution
  • avoid using commas in names
  • enter the group manager in "managed by"
  • enter any group members
• If this is a delete or subtractive modification, any removals need to be done manually in SN.
• If this is a create or additive modification, the import job needs to run. The SN group import will run at midnight, after which a SN admin must modify the group record:
  • manually enter queue managers into the "Team Leads" list
  • manually tag the group as Tier 1 if appropriate
  • manually edit the list of Provider Services as appropriate
  • manually edit the list of Group Email Aliases for inbound email as appropriate
  • manually edit the list of Service Contracts as appropriate

Making the changes to Active Directory

There is a separate page just for this. See Configuring ActiveDirectory using Windows 7 virt for ServiceNow

Forcing the Active Directory scheduled job to run immediately

This requires logging into ServiceNow as an administrator rather than as a regular unprivileged user. It is a bad idea to grant privileges to a regular user, but instead, we should create a separate account. Because this is a separate account, without a NetID, we also cannot use the regular CAS-ified front door for ServiceNow.

Instead, we need to go to:

https://yale.service-now.com/side_door.do

and enter the admin credentials.

Then look for Scheduled Imports (you can type 'Scheduled' in the top search box and it will constrain your UI to a usable subset) -> Then find Yale AD / Groups Import

Choose to Run Now on that import.

Then look for Progress Workers.

If you click over there fast enough, the import will be orange and still running. But it runs pretty fast. It will probably be in the history listing, and be colored green.

That's it. If you want to verify, you can choose Groups from the admin console, find the relevant group you modified, and verify the user adds applied properly.