Client set for "modifiable" history

Question: How can you determine WHEN a client was set to modifiable? Auditors would like to know how many times the client was set for modifiable during a period of time? Is there a a report to do this? Other method?

Answer:
Try transaction SCU3 for table T000. Table logging needs to be on.

The_Bean

Answer:
Thanks. That worked perfectly.

Client open restriction for transaction SCC4

Question: Hello All

We are on SAP R/3 Ent 4.7x1.10.

How can we ensure that the client is not directly opened through SCC4 even by those users who have got SAP_ALL authorizations?

Regards.

Vimal Soni
_________________
Vimal Soni
+91-9425459091

Answer:
SAP_ALL is editable... like all other profiles. However, once it is regenerated, all your changes are lost.

But it really sounds as if the wrong users have SAP_ALL on your system. Shouldn't you address that problem instead of mutilating standard SAP? I suggest you create more appropriate superuser roles to protect your system.

client independent job

Question: Is there a simple way to tell if Jobs I am scheduling are client Independent or client Dependent?

I have received advice to run them all in 2 different clients and compare results, but I would assume there is a simpler way.

Many Thanks!

Answer:
no way to know from the program name... you need to analyze tables queried in these program and look if they have the MANDT field.


anyway... this has nothing to do with SAP security...

If my answer is not good enough, ask this in the ABAP forum.

client export in 3.1I

Question: I have a requirment to dump all the User related data from one system to another system.
This can be done by client export.
In 3.1I there is a profile SAP_USR (Authorizations and user masters) does it cover all user info..i.e user details,profiles ,activity group...etc

Answer:
Yes, but it is only good to a freshly created client, do not use it in a client where you already have users defiend, SAPOffice and workflow, and possible entries on SU01 will get corrupted.

Answer:
I have a requirment to dump all the User related data from one system to another system.
This can be done by client export.
In 3.1I there is a profile SAP_USR (Authorizations and user masters) does it cover all user info..i.e user details,profiles ,activity group...etc

Yes, this is what this profile is used for.
_________________
SapFans Moderator
NetWeaver ‘04–SAP Web AS for ORACLE certified

Search: /forums/search.php
SAP Notes: http://service.sap.com/notes
SAP Help: http://help.sap.com
Basic Rules: /forums/viewtopic.php?t=222759

Answer:
SAP_USR didnt get the activity groups!!


In 3.1I it doesnt cover acitivty groups ??In client export and import there is no error but there are no activity goups.

Answer:
Use report RHMOVE30 in the 3.x and 4.0 versions, useless in higher versions.

Answer:
Thanks for your reply.

1>Is there any procedure to be followed or any changes to be made in system before executing report RHMOVE30 ?

2>What does it do exactly ? Does it only pick up activity group data or any other data also?

3>Where does it store the output data after execution of this report?

4>How to import the output data in target data ?

Client Copy

Question: Hi

Whenever our basis people do a client copy from production to QA (to provide quality test data), my authorizations on QA become similar to my authorizations on production. Can't they do a client copy without affecting authorizations?
_________________
Nandi
Version 4.6C

Answer:
This is probably more a question for the Basis forum. Nevertheless I know that it is possible to make client copies either with users & roles or without. So it is possible to copy configuration without users & roles.

Answer:
Ok. Anyway it will probably be impractical because they want users to test under the same conditions on QA. It is only us, the ABAPers, who have special requirements to see and do anything on QA and see and do nothing on production
_________________
Nandi
Version 4.6C

Answer:
You can export out the user from QA do the client copy and then import the user back in. This will ensure that all your user master are same as before and thus retaining the same level of access before. You can ask the basis person doing the copy to export the user out on QA which will generate a transport request and hold all the user master record there once the client copy is completed the transport is imported back and the PRD user master on QA are overwritten with the original users on QA.

Hope this helps!

Answer:
Thanks a lot!

I will see if I can convince those guys to do that.
_________________
Nandi
Version 4.6C

Answer:
One more side to the question: perhaps you don't use client copy but a _system_ copy. In that case the authorizations are always copied.
The point is that more often than not, production copies are done with system copy because client copy would take ages.

Answer:
you basis should export userID and security on your QA system BEFORE refreshing it. just ask him to use SCC8 with selected profile SAP_USER

then he can import it back wth STMS