I had a mass change occur and it was not something that was scheduled. How can you track unauthorized mass changes?

a mass change occurred but I am unable to track down how it happened.  Mass operations are not allowed in my settings. Updated dates do not reflect when 1700+ accounts were affected.  All of these accounts were of a specific type and they were all changed to one specific account manager.  I need to find out how and when this happend.  Any help would be appreciated.   Because putting them back is not easy.

  • 0

    Hi Bill

    Is this a change to the Company record? 

    Changes made to a row made through the Sage CRM interface should be recorded in the xxxx_updateddate and the XXXX_updatedby fields.

    The large scales changes can be made by the obvious "Mass Update" feature.

    But other features can made sweeping changes.  For example within the User admin screens a user's work in progress can be reassigned to others.

    Escalation rules can make sweeping changes - there is an SQL Update Action - and this could be unintentional.

    Another unintentional impact could be an UpdateRecord function within a Table Level Script that cascades a change through multiple records.

    If the Company (Account) was reassigned, where the opportunities, cases and communications reassigned?  Do you have clusters of data changing at once?

  • 0

    Hi Bill

    As  points out there are other ways to mass update records other than the 'Mass Update in Groups, also want to check that someone didn't do this via direct access to the database (e.g. One off SQL Script, a trigger on a table or a SQL timed job)? Unfortunately there would be no signs of this happening, along with the other areas to consider (Table Level Scripts, 'Reassign' on the User Account - though I think the latter would update the xxxx_updateddate and xxxx_updatedby fields (need to test that)) 

  • 0 in reply to Matthew Shaw

    If you have a backup of the database of before the change, you could restore it as a temporarily database and via a SQL Update script use it to change all the data back again

  • 0

    If it was done through the product and your logging was high enough then the update(s) should be in the SQL.log this should help you track down at least initally where the update came from (internal/external).

    Otherwise there are tools out there that allow you to compare two DB's and locate the differences between the two, and script out the SQL.

    One thing to remember to check is the _updatedby and _updateddate fields if these where updated that i would lean more to product as people can be lazy and forget to update these when doing external updates.

  • 0 in reply to Sage CRM

    I looked in the logging section, but find nothing specific to the change that occurred.

  • 0 in reply to Bill Johnson

    opportunities and communications were not reassigned.  The "updated date" and "updated by" did not reflect the change.