Video Screencast Help
Endpoint Management Community Blog

Closing Resolved Status Incidents after a Defined Period of Inactivity

Created: 02 Aug 2007 • Updated: 02 Aug 2007 • 9 comments
EFMagnuson's picture
0 0 Votes
Login to vote

To close, or not to close, that is the question many of us face while staring at an aging list of help desk tickets. Here's the process one Juice reader recently implemented to save his staff a couple hours a week and (you're way ahead of me) get some closure. :)

The Eminent Problem

When an Incident is resolved our Helpdesk workers place the Incident into "Resolved" status (in our previous system this was "Resolved: Pending Follow-up"). All of our reporting metrics and notifications have been altered to count "Resolved" status Incidents in much the same way as "Closed" status. However, due to the intrinsic differences between the two statuses we still have need for the "Closed" status and to pull separate metrics on Closed verses Resolved Incidents. When an Incident is placed in Resolved status the requestor (contact_name/contact_email) receives an e-mail letting them know that the Incident has been resolved and to let the Incident Worker (assigned_to_worker_name/assigned_to_worker_email) know if there are any further challenges related to the Incident. Keeping it in "Resolved" status for a time allows the Requestor to re-open the Incident for continued work if required. If no follow-up or further work is required after five days, the worker(s) can then go and fully close the Incident. Unfortunately, because of low staffing levels our workers cannot always perform the proper follow-up or go back through their Resolved Incidents for closure on a daily basis.

The New and Improved Process

We decided to automate the transition from Incident Resolution to Incident Closure. We wanted the system to automatically scan for Incidents in "Resolved" status for more than 10 days without change (this gives both Worker and Contact a grace period to confirm Incident Resolution and perform in person follow-up, if possible) and change the status of the selected Incidents from "Resolved" to "Closed." We achieved this through an automated notification task in the Notification Server.

The Payoff

By automating Incident Closure and follow-up after a period of inactivity our Helpdesk workers have been able to focus on current and upcoming tasks rather than having to worry about past and Resolved tasks. It is a recent change in our system but we are estimating that it will save each worker about 4-6 hours per week in follow-up time.

Comments 9 CommentsJump to latest comment

lokisson's picture

ITIL says that you may close resolved incident after 21 days of inactivity from user. In some cases you better call-back to user that issued incident and make sure you resolved an incident.

Login to vote
riva11's picture

During the past IT Audits (according to Sox/Cobit process) , internal and external auditors requested that all HD tickets remains open witing a user feedback. After 30 days before for any closure we have to contact user for the feedback input on HD systems, only in this case we can force the closere.

Login to vote
xmoreland's picture

I think it is great to automate this. I think it is just simply the way it should be. Being able to set the number of days is a bonus and should just be the way it is!

Login to vote
karanmalhotra's picture


Could you help me with the steps i would require to set this up?

Login to vote
EFMagnuson's picture

I haven't been on the Juice Forums for a while.
Here are the steps I took to enable this automation:

  1. In the Altiris Web console go to "View" > "Tasks";
  2. Expand the directory tree to the location where you would like to create the Task (in our case we placed it in "Tasks\Incident Resolution\Incidents\Helpdesk\Notification Policies");
  3. Right-Click the Folder and select "New" > "Notification Policy";
  4. In the "Name" field, type the name of your new Notification Policy (e.g. "Close Resolved after 10 days");
  5. If desired, type a brief description of the rule in the "Description" field;
  6. First, we need to create the Query that will select the proper Incidents:
    1. In the "Source" dropdown, select "Query";
    2. Click "--Edit Query--";
    3. Click "Edit SQL Directly";
    4. Copy and Paste the following SQL args into the input box:
    5. SELECT DISTINCT hd1.[workitem_number]
      FROM dbo.HD_workitem_current_view hd1
      WHERE hd1.[workitem_status_lookup_id] IN (400)
      AND datediff(d, hd1.[workitem_modified_on], getdate()) >= 10

      NOTE: By changing the "10" at the end of the argument, you will change the the required period of inactivity for the rule to work.

  7. Click "Run" to confirm the query works;
  • Since we required this to be fully automated, we want to create a schedule for it:
    1. In the "Enable Schedule" dropdown, select "Custom Schedule";
    2. Click on the link to the custom schedule;
    3. In our case we want to run the task every day at 9:00 AM so our system will stay on top of Incident Closure, but you can select any schedule that suits your needs;
    4. Click "OK";
  • Now to add the Automated Action that will actually change the Incident Status:
    1. From the "Add action type" dropdown, select "Edit Incident Automated Action";
    2. Click "Add";
    3. Enter the action Name and Description as desired;
    4. Click the "Enabled" check box;
    5. In the "Execute" section, click the "Once per row" radio button;
    6. In the "Incident" input box, type:


    7. In the "Comment" field, type a comment that will let any reviewer know that the Incident was closed by automation (e.g. "This Resolved Incident has been automatically Closed due to 10 days of inactivity after Resolution.");
    8. From the "Status" dropdown, select "Closed";
    9. Click "OK";
  • Enable the Task by clicking the "Enable" checkbox at the top of the page;
  • Click "Apply".
  • 0
    Login to vote
    sanderville's picture

    This looks good but we want to reassign auto-closed calls to the last modified by worker so we can take metrics from it.  By default our Resolved calls are assigned to a separate queue so the helpdesk manager can do QA while closing the calls.  Now we have a huge backlog and want to close calls automatically.  The "Edit Incident Automated Action" only allows us to reassign to one entry in the workers list.

    Is it possible to do what I want from the NS? 

    Login to vote