How can I create multiple User Id at Random

We usually created Id though SU01, it only one by one. Can I create multiple user id having same profile at once.

Yes you can, use tcode SCAT. First, make sure your client setting (SCC4) is enabled with ' X eCATT and CATT allowed'. Just in case your Production disabled this.

- Then, you need to create a simulation (test case) of creating new user id by calling tcode
SU01 later.
- Test case must start with Z, example ZCREATE_NEW_USER. Create this case, put title and
choose component as BC (basis components).
- Save and choose Local if you dont want to transport it or choose a dev. class (example ZDEV)
if you want to transport it later.
- Go back and click Change button. Then key -in Object as example SU01, and choose Record
button on top. When it prompts to enter Transaction code, key in SU01 (if for roles,
key-in PFCG) and begin recording. As usual in SU01 create 1 user id, dept field, password,
roles, group and so on.
- Make sure you press Enter on each field because we want to capture the value/object and
SCAT is a bit stupid if you become familiar later....but still useful...indeed.
- You will see a clock on the bottom which means the recording process is on going.
Once done, click Back button and press End button to end the recording.

Note - I noticed you said the profiles are all the same. Then this is much easier...no need to enter the roles/profiles, just duplicate this ID and change the name, dept and password only.

Okay..first stage has finished. Then double click the Object to begin inserting parameters. Then you will see an object for each fields that you run from SU01. Choose the right field example user id (BNAME) and choose button 'Insert Import Parameter (F6)' and you may click Next Screen to 'watch' what have been recorded and proceed to choose several other objects like password field (PASSWORD1, PASSWORD2), roles field (AGR_NAME), group field etc. If you happen to choose the wrong object, then you can reset back (Edit -> Reset Parameterization). You may see so many junk fields captured and this is because SCAT records every steps/dialogs.

Once done, choose Back and save this case. Then you need to click 'Goto -> Variant -> Export' and save it. After that use Ms Excel to open it and begin inserting all other user ids. Save and close. Remember to close this file because SCAT will use it.

Then last one, get back to SCAT and click button execute, processing mode chose Background, choose external file 'the one you created with Excel' and execute. At this moment don't use tcode SU01 bcoz you may interrupt the simulation. Wait for the logs. If you see reds then error was
happening.

Hoping this will help you. I have done (Sap 4.6C) this to create thousands of user ids and also thousands of roles/profiles (pfcg). I heard with Sap 4.7, the SCAT has so many extra features.....

How to Hide the User Menu

To put it simple, when the user logs on to the system he should have only the SAP Standard Menu.

You have two ways to control this :

1. Default hide for all the SAP users.

Goto SM30 and edit the table

SSM_CUST

and set

ALL_USER_MENUS_OFF = YES

and transport the same in production server.

or

2. Hide based on individual SAP users.

you can also try SM30 and maintain table

USERS_SSM

for individual users.

How to delete expired roles?

Here are 3 notes you may want to review to see if there is any helpful info, plus some documentation that may be helpful for others....we are going from 40B to 47 and have had a few issues with role deletion

Notes: 312943 504412 & 313587

Additional info

First, the report PFCG_TIME_DEPENDENCY is functioning as designed.

It was not designed to remove activity groups.

Second, in transaction SU10 you must have the valid from and valid to fields filled in with the actual dates, 04/08/2002, in order to remove the invalid activity group. You need to be sure that the remove user radio button set in the role tab. But in the profile tab, the add user radio button is selected by default. What you have to do is go to profile tab and select the remove user radio button. You have to make sure both role and profile has the same radio button selected, i.e. remove from users. Only then when you click save, it will allow you to delete the role from user.

In transaction SU10, you need to complete the following steps:

1. Click on the Authorization data button.
2. Entry the users name, latimerc
3. Click on the execute button.
4. Put a check in front of the users name.
5. Click on the transfer button.
6. Now highlight the user.
7. Click on the pencil button.
8. Click on the Activity Groups tab.
9. Enter the profile name

(PM_NOTIFICATION_PROCESSOR).

10. Enter the valid from and valid to dates (04/08/2002).
11. Change the radio buttons to remove user from both the Activity Group and Profile Tabs.
12. Click on the trash can.

In another customer message the following was provided by developement:

We don't have a regular functionality for mass deletion of roles. But if you want to avoid the deletion by hand or with an own created report, I would suggest the following:

The attached note 324962 includes the report ZDELETE_RY_T_AGRS

which could delete all roles with names like 'T_....' or 'RY....'. The report

gives you a list of all these roles and deletes then the selected ones.

You can modify the report to get all your roles in the selection list.

Therefore you have to change the following:



SELECT * FROM AGR_FLAGS INTO TABLE L_AGR_FLAGS

                    WHERE FLAG_TYPE = 'COLL_AGR'

                    AND   FLAG_VALUE = 'X'.

SORT L_AGR_FLAGS BY AGR_NAME.

LOOP AT SINGLE_ACTGROUPS WHERE AGR_NAME+11 <> SPACE AND   <<< delete

         ( AGR_NAME(2) = 'T_' OR AGR_NAME(2) = 'RY' ).   <<< delete

LOOP AT SINGLE_ACTGROUPS WHERE AGR_NAME+11 <> SPACE.      <<< insert



READ TABLE L_AGR_FLAGS WITH KEY AGR_NAME = SINGLE_ACTGROUPS-AGR_NAME

                           BINARY SEARCH.

Text from an additional customer message as further help:

- go on role tab

- select remove from user

- enter ZR.PRD.GENERIC and date : 06/04/2002 12/31/9999

- go to profile tab

- select remove from user

- save

- do the same for ZR:HR:ESS from 01/01/2002 to 12/31/9999 and worked



from date for testid was 01/01/2002 and testid2 02/01/2002 and the 2 assignement were deleted And the roles were


removed from the 2 UMR.

So it works as designed.

Different methods to Lock or unlock SAP users

Is there a way in SAP to unlock a locked user for a limited time, then automatically after x time set the user back to lock status?

You can fill in "valid from" and "valid until", but you cannot say from Monday to Friday from 8 - 12:00 for part time workers.

Can we schedule to lock all users?

If users get locked, from SU01 you can unlock them.

Use SU10 to mass lock/unlock the users.

Use address data or authorisation data to get a list of users - select the ones you want and

click transfer.

Once this is done click on lock or unlock.

You can also use transaction code EWZ5 to mass lock/unlock the users

or

Execute program EWULKUSR in SE38

or

Set a profile parameter (login/failed_user_auto_unlock)

to unlock at midnight the locked users.

or

Here's an ABAP code, short and simple, isn't it?

REPORT zreusrlock.



DATA: time_limit TYPE sy-datum.

DATA: days TYPE i VALUE 40.



time_limit = sy-datum - days. 

UPDATE usr02 SET uflag = 64 WHERE trdat < time_limit.

If you don't want to specify the time in the program, you can use SE38 to schedule it as a daily background job with the date and time.

or

Probably the easiest way would be to write a sqlplus SQL script that sets all the UFLAG fields in table USR02 to 64 EXCEPT for the BNAMEs you don't want locked. When you are done, you can do the same again but change the UFLAG field to 0.

The SQL statement would look like:

update SAPR3.USR02 set UFLAG = 64 where MANDT =

 and BNAME !=  

AND BNAME != ; 



You can replace != with <> if you want.

To run this from an OS command line, you would type: 



Unix/Oracle 8---> sqlplus internal @

NT/Oracle 8.0---> plus80 internal @

NT/Oracle 8.1---> sqlplus internal @s

Unix/Oracle 9:--> sqlplus /nolog @

NT/Oracle 9-----> sqlplus /nolog @

In UNIX you can cron the script to schedule it. In NT you can schedule it as a task.

or

This is another method to UNLOCK ALL users.

Start Oracle Server manager (I assume you are on Oracle)
connect internal
update sapr3.usr02 set uflag='0' where mandt='399';

When users are locked, the uflag is set to 64.

Finish, just query to check.

select bname, uflag from sapr3.usr02 where mandt='399';

Please note that unlocking users from low level (like Oracle sqlplus) should be used as last resort. Frequent use of low level access may tempt you to use on other things. Highly dangerous and your IS auditors will not be too happy.

Is there a way to set a list of users that cannot be locked, even if we try to lock them manually, and even if they fail connection ( wrong password )?

Increase this parameter in SAP Instance profile:

login/fails_to_user_lock = 6 (max is 99 wrong attempts, i.e, value 99).

Currently you have a value of 3. 



login/failed_user_auto_unlock (for your midnight unlocking). 

Ask users to remember passwords!! If someone is deliberately login-in with different username/password (thereby blocking legitimate access of that user), check hostname from SM21.

What is difference between Ketnal upgrade and Kernal Patching

Kernel upgrade involves upgrading your executables. i.e., you are using 620 kernel and migrating to kernel 640 is termed as Kernel upgrade

Kernel patching involves applying the patches for the current kernel. You will be using the same kernel level after applying patches, but the kernel patch set increases.

Quick Guide to Patching your SAP System

I need to upgrade our internal demo systems every once in a while. Now, as I don’t unleash my Basis skills on customers everyday I tend to forget how its done. I decided to record the steps here to save me a bit of time next time around. Please treat any advice given here with care(I’m no expert at this) and read the official guides and help files.

Applying patches to an SAP system is not as simple as, say updating your Windows PC. There is no auto update or one click upgrade process. I will be surprised if there ever will be. The thing is, SAP actually allows you a lot of freedom and flexibility in changing the way it works(Windows doesn’t). The price you pay is a slightly complex upgrade process.

Doing a full Support Pack update of an SAP system broadly involves the following:

1. Log in to the Service Market Place and select the packages to be downloaded. Admittedly, this is a bit easier now with SP Stacks.

2. Log on to your Solution Manager System(Maintenance Optimizer) to confirm your download basket. If you don’t do this you can’t download your Patches. I must still figure out what the benefit of this is.

3. Download the files using the SAP Download Manager.

4. Use sapcar to extract the patches. You can use the command sapcar -xvf from command line to do this. An easy way to extract these files in Windows is to register the extensions .CAR or .SAR to open automatically in Explorer.

You can do this by opening Windows Explorer and going to Tools->Folder Options and clicking on the File Types Tab.

Create a new type for the .CAR/.SAR file types and create a default action as shown in the screen shot below( Copy SAPCAR.EXE to your C:\Windows directory first).

How to Download the supportpacks from servicemarket

1) Login into the website https://websmp104.sap-ag.de/swdc using
your userid and password

2) Click on Downloads--->SAP Support Packages--->Entry by Application Group

3) Click on SAP Application Components--->

Choose products according to ur requirements

SPAM Error

DATA type "PAT03" was found in a newer version than required.

oracle_SID not defined ENTER THE hkey_local_MACHINE -> SOFTWARE> ORACLE ORACLE_SID = PRD

When is a good time to start using the Note Assistant?

In principle, you can start using the Note Assistant at any time. We recommend that you start using it as soon as possible. There are no technical restrictions concerning the start time.

If you implemented corrections contained in SAP Notes manually before using the Note Assistant, you must make them known to the Note Assistant. This helps to administer the SAP Notes in your system. It is also necessary for implementing SAP Notes using the Note Assistant. If you use the Note Assistant to implement an SAP Note that has corrections from SAP Notes as a prerequisite, the Note Assistant must "know" that these corrections were already implemented. Otherwise, the Note Assistant will implement the corrections again.

Procedure

1.Load the Note Assistant add-on for your SAP R/3 Release from the SAP Service Marketplace and install it using the SAP Add-On Installation Tool.

1. To register the SAP Notes with the Note Assistant, execute program SCWN_REGISTER_NOTES.

For future Support Package imports or upgrades, the corrections from the SAP Notes are displayed in the category SAP Note corrections in the modification adjustment function. The system determines automatically whether these SAP Notes have to be implemented again or reset to their original status.

Note: These corrections are also displayed under the category With Modification Assistant or Without Modification Assistant. This is necessary since you may have further modified these objects. You have to decide whether the objects can be reset to their original status or whether you want to keep your modifications.

After a Support Package Import/ Upgrade

For practical reasons, we recommend that you start using the Note Assistant after you have imported Support Packages or after an upgrade. This has the advantage that there are fewer or no SAP Notes in your system that you need to register with the Note Assistant. If you upgrade from a release below 4.5B, which the

Note Assistant does not support, to a release 4.5B or higher, you should install the Note Assistant before you perform the modification adjustment.

Procedure

• Load the Note Assistant add-on for your SAP R/3 Release from the SAP Service Marketplace and install it using the SAP Add-On Installation Tool


• Reset the correction from the SAP Note to its original status using the modification adjustment function (transaction SPAU). If you have further modified the objects and you want to keep the modifications, make sure to re-insert them afterwards.


• Load the corresponding SAP Note into the Note Assistant and implement it.


• If you have inserted your own modifications to the source code, re-insert them now.


• Repeat these steps for all corrections from SAP Notes and complete the modification adjustment


• Register the remaining SAP Notes using the program SCWN_REGISTER_NOTES.

Note: Make sure you do not execute the program before completing the modification adjustment. The program only checks that the validities of the registered SAP Note are true. It cannot check the content.

How should I implement an SAP Note using the Note Assistant?

Prerequisites are that you already know the number of the SAP Note that corrects the error and that the SAP Note contains correction instructions.

• Start the Note Assistant (transaction SNOTE).


• Download the SAP Note from SAPNet - R/3 Frontend. To do this, choose "SAP Note Download" (Ctrl + F8) and enter the relevant SAP Note number. The downloaded SAP Note appears in your worklist under the category New.


• Read the SAP Note!>/li>
  
• Check whether the SAP Note entails manual activities. (See also answers to questions concerning ABAP Dictionary objects, function module interfaces and messages.)·


• If this is the case, first perform the manual activities.


• Implement the SAP Note. To do this, choose Implement SAP Note. During implementation, the Note Assistant may download prerequisite SAP Notes that must be implemented before.


• Also read and check the prerequisite notes! This is necessary, since they may also contain manual activities. If you don´t do this, the syntax check can bring up an error of the relevant field of the function module, for example.

How can I load SAP Notes?

To load SAP Notes, you need to create an RFC connection to SAPNet - R/3 Frontend. For more information, see the Note Assistant documentation under "Installing the Note Assistant". Currently, it is not possible to download SAP Notes from the SAP Service Marketplace

What is difference between PI and PI_BASIS?

PI and PI_BASIS are two different components.

PI is the abbrevated form of Plug In. AddOn components or extension sets are installed above core SAP and they integrate or communicate with the core using PlugIn component.

PI_BASIS is the core component or a single version for different PlugIns.
Hope you can understand what I meant in the answers above.

What happens if a Support Package overwrites corrections that I have implemented with an SAP Note?

The system checks whether corrections you implemented with an SAP Note have been overwritten by a Support Package that does not contain these corrections (yellow traffic light in the Modification adjustment function). In this case, you must implement these corrections again. To do this, double-click the yellow traffic light.

What can I do if an SAP Note has the status Cannot be implemented?

• Check that the SAP Note corresponds to the validity of your system. The validity applies to the software component, release and Support Package level.
  If the validities do not match, the Note Assistant cannot implement the corrections. If you feel that the validity of the SAP Note is not correct, open a problem
  message and assign it to the component of the SAP Note.


• Check that the SAP Note contains correction instructions. Only SAP Notes with correction instructions can be implemented.


• Read the SAP Note. It is possible that manual activities are described in the long text of the SAP Note. You must perform the changes manually.


• Make sure that you have implemented the latest version of the SAP Note. To do this, choose Download current version of SAP Notes.

How do I know that the SAP Note involves preparation or follow-up activities?

You have to read the SAP Note carefully to find out about preparation or follow-up activities. The Note Assistant reminds you to read the SAP Note. It does not automatically identify whether additional activities are required.

How can I determine whether a SAP Note has been implemented with a specific transport request?

If an SAP Note is implemented using the Note Assistant, the corresponding transport request is assigned the attribute SAPNOTE. You can use the Transport Organizer (transaction SE09) to check for any transport request whether it contains a SAP Note implementation. If you want to find out all the transport requests that contain SAP Note implementations, use the Transport Organizer Tools (transaction SE03): "Find Requests". Expand the list and look for requests that contain the attribute SAPNOTE.