Assets Subject to Legal Hold

Hi ITAM fam,

We have a process to recover assets when an employee/contractor is terminated. When person’s HR profile is updated to inactive, it triggers the workflow in ServiceNow and creates catalog tasks that need to be worked on before closing the request. Then the devices are wiped “re-imaged”

how do you incorporate the devices that are on legal hold and cannot be wiped? We want the request/ticket/task to be sent to the legal department. How can this be done? I know an enhancement needs to be submitted. I think my question is, how to we know when an asset is on legal hold, where can ServiceNow grab this data from so it can trigger a workflow? Hope this makes sense.

1 Like

@dinamac01 - we worked out a process where HR has a list of people terminating/leaving a company. That list is passed through a legal review to determine who will be on legal hold. I would recommend you work with your legal team on who holds that list. The other way is through your AD or Identity team. They are usually notified of which users are on legal hold and will have to “freeze” their mailbox till the legal review is done or completed.

I’m sure there are various ways to do this and other people can chime in.


1 Like

I second the recommendation to check with your AD or Identity team or whomever is notified of a mailbox freeze. (In our organization it’s our “Messaging and Collaboration” team.) They will be the first ones notified by Legal or Security when a freeze is needed, so you can just piggyback on their process for notifications.


One specific addition - since you’re already using a SN workflow on the terminations, I’d suggest adding a legal hold option to the front end form, and if that field is selected, use the existing workflow to spin off a task to Legal (or HR) to monitor the Hold duration, and then once they approve/close their task, you can continue the workflow to generate the task to the desktop team to reimage that machine that’s been stored.

Also, sometimes you can convince the related orgs to let you yank the Hard Drive out and store only that, then insert a new Hard Drive into that machine and put it back into service.