SAP_ALL - when is it used in PRD

Communication) is it appropriate to give SAP_ALL Profile to in the live PRD system?

Answer:
None, and SAP* should only have it added when you need to usethe ID... Nasty little loopholes inteh system exits tha can be prevented by having NO ID having SAP_ALL./

SAP* locked in client 066

Question: Can anyone help?

In our Earlywatch system (066), the earlywatch and sap* accounts have been locked and no-one knows the passwords. Is there any way I can unlock these user accounts via another SAP client or would the DBA guy have to unlock the accounts at the database level.

Help.........urgent

Thanks

Answer:
Rather use the DB guy than have someone post the solution here!

Otherwise, post your email address.

Ned

Answer:
Use your Database Tools. In MSSQL:
RUN THE FOLLOWING IN THE 'SID' DATABASE QUERY ANALYZER:

select * from USR02 where MANDT='000'
update USR02 set UFLAG=0 where BNAME='SAP*' and MANDT='000'


Or

Use ABAP code:

Or disable parameter login/no_automatic_user_sap_star (value 0)
delete sap* user
recycle system, sap* auto created with default password.

Best method. Create an ABAP program that can only be run by a superuser specified for the purpose, add the superuser to the filters in security audit logs to log usage, use this user to run the program once a month to unlock and reset pw for your SAP standard users in all clients.
Maintaining this consistant security method ensures a consistant auditble method of keeping these users secured and logged without various SAP support people having to resort to radical methods to enable them when the pw are forgotten due to being different in every client. Having a defined and documented maintenance method that is enforced with a check list or other reportable control will serve to keep these users from being abused, and at the same time serve their designed purpose when needed without unnecceary delays due to having to "fix" them when they are needed.
_________________
Gary Morris
SAP Security Analyst/Developer
garymorris@sapsecurity.net

Answer:
Please do not use URGENT in your topic title.

If it's really urgent, open an OSS message at SAP with priority VERY HIGH. They will answer you within 30 minutes... or they will tell you like me that your problem is not urgent!

is your production server down? nope!

Next time, please read Basic rules...

topic is locked

sap* cannot use transaction su01

Question: Dear all,
I have created a new client and with a user sap* created without the profile sap_new/sap_all.
Now I could not use the transaction su01.
Could anyone help me to overcome this problem.
Thank you.
Regards,
Clarence

Answer:
Dear all,
I have created a new client and with a user sap* created without the profile sap_new/sap_all.

solution:

created a user sap* with the profile sap_new/sap_all
..or use DDIC


Answer:
Go to another client, use a client independent transaction to insert authorizations into your new client´s auths for SAP*.

SAP* id deletion

Question: Can a user , who is having access to delete user master records , also delete SAP* id with the same authorization?.

Regards,
Shammi

Answer:
yes
_________________
SapFans Moderator
NetWeaver ‘04–SAP Web AS for ORACLE certified

Search: /forums/search.php
SAP Notes: http://service.sap.com/notes
SAP Help: http://help.sap.com
Basic Rules: /forums/viewtopic.php?t=222759

Answer:
Please don´t lock this topic, it has potential!

Answer:
Which means that if SAP* ID is not locked, then the person having access to delete user ID can pose a security threat?...

Answer:
If the system parameter setting for login/no_automatic_user_sapstar
option is set to '0', and the SAP* user record is deleted, then a user can log on the SAP system with SAP* ID with the password 'PASS' with full access rights to the system. Access through the SAP* ID is then not subject to authorisation checks and accordingly allows the user unrestricted access.

Answer:
the best practise is to secure the SAP* userid by changing the parameter login/no_automatic_user_sapstar . Then create a userid by the name of SAP*, don't assign any roles to it, put it to a secure usergroup, put it as background type and lastly lock it.

by doing this, nobody can use it anymore.

Answer:
You can limit what user groups can the admin modify.

Put the SAP* into the SUPER group and exclude the SUPER group from auth. object S_USER_GRP.

SAP* and DDIC locked

Question: Hi all,
I seemd to have forgotten my SAP*,DDIC passwords (modified the originals) and now I am lockedout.
Can any one help me to understand a way to get into the server and unlock the users.
I dont have any other userID's with SAP_ALL access and thus I cant really logon and try su01

Thx in advance

Answer:
Hi all,
I seem to have accidentally locked DDIC and SAP* on my system.
I can get on to the server and access data. Please help me unlock myself.

Thx in advance.

Sekhar

Answer:
If you are a basis person you should know how to do this otherwise us telling you is risky as we do not know who you are

Answer:
Hi,

Sekharnet, you first please clarify whether sap* and ddic are locked or you have forgot their passwords..
_________________
Suril

A conclusion is simply the place where you got tired of thinking.

Answer:
Give your best shot Suril!

If there is too much information, Snowy will be sure to take care of it.

Answer:
Either with a test ABAP ( requires a developer key) or with function module RFC_ABAP_INSTALL_AND_RUN, login to a client you know the password or can reset it and run the following report

REPORT T. Tables usr02.
Select single * from usr02 where bname = 'SAP*'.
usr02-mandt = '000'. "change to the target client
Modify usr02 client specified.
commit work.

UST12 Table not getting updated when transporting BIG role.

Question: We have a HUGE role with tons of trans and authorization objects, where we made a change to an object S_USER_GRP with 03 and 08 as activity and * for User Group in DEV. Transported the change into QAS environment. Transport has been confirmed successful. User can't access auth and SU53 is below. When you look at the role in PFCG on DEV at object S_USER_GRP everything looks OK. When you look at the object on QAS in PFCG, S_USER_GRP shows 03, 08; $CLASS. When you view the UST12 table on QAS it shows 03, 08; *. What is the deal? Is there a phantom somewhere?

SU53:

The following authorization object was checked:

Object S_USER_GRP User Master Maintenance: User Groups
Object class BC_A Basis: Administration
-------------------------------------------------------------------------
| Field Value |
-------------------------------------------------------------------------
| Activity |
| 03 |
| User group in user master maintenance |
| SUPER |
-------------------------------------------------------------------------

Available authorizations for the object in the master record:

Object S_USER_GRP User Master Maintenance: User Groups

Authorization 223__:SSSW00 Available in User Buffer
Profile 223__:SSSW4
Role 223__:SSSW
-------------------------------------------------------------------------
| Field Values |
-------------------------------------------------------------------------
| Activity |
| 03, 08 |
| User group in user master maintenance |
| $CLASS |
_________________
Regards,

Pam Gray
Texas Instruments
SAP Security Developer/Analyst

Answer:
Transport table USVART, USVAR and USORG and it should correct the problem, It appears someone created an orglevel out of the authorization group in QAS.
then regenerate the role or retransport it.

Answer:
Just to add that the role should work if you haven't edited it in QA, as John said the Org level hasn't been created but the underlying access should be there. Still it's best to have consistency throughout your environment.

USR40 table

Question: Would anyone be willing to share a list of password exceptions from there USR40 table? I am not interested in the entire dictonary as some have suggested in the past. 20-100 entrys would be fine. Please email the file to homs@sbcglobal.net if you can
Thanks,

Mark

Answer:
You can minimize the list by setting the system parameter for the password to be 8 characters, you then do not need to worry about the less than 8 character words.
If you are in a high enough version you can force alphanumerc and/or the addition of special charactes, eliminating the need or greatly reducing the need for USR40.

It is generally filled with loal sports teams, company names and monikers.

Answer:
John,

We have limited to 8 characters but the "SOX Auditors" want more entrys in the table. What version or support pack level enables password complexity?

Thanks,

Mark

Answer:
THen have them give you the "approved" list.

Late 4.6 and 4.7+ I believe allows you to use these parameters, search in OSS for more info and if there is a support pack to apply to lower versions.

Answer:
John,

We have limited to 8 characters but the "SOX Auditors" want more entrys in the table. What version or support pack level enables password complexity?

Thanks,

Mark

if you are on 4.7 & use the special chars you will have mitigated the risk. The auditors will be looking for a particular risk - something like passwords should be periodically changed and not easily guessable.

A well configured USR40 will be able to do this, as will a combination of alpha & numeric chars & a minimum number of char changes etc. You can prove the risk is mitigated using either method.

Unfortunately your SoX auditors are not permitted to supply you with entries for USR40, however there are lots of generic password lists on the web which will suffice.

Answer:
Unfortunately your SoX auditors are not permitted to supply you with entries for USR40. If they are adding value they do supply you with a list or at least "recommend" one

Answer:
Unfortunately your SoX auditors are not permitted to supply you with entries for USR40. If they are adding value they do supply you with a list or at least "recommend" one

Unfortunately most auditors do not add value.

If they are performing SoX review then technically speaking, advising on how to mitigate a risk would be outside the scope of what they are permitted to do - giving someone a list of passwords could fall under this is they were being pernickity.
If an audit firm is assisting with SoX (i.e. they are not the financial auditor) then they can give you what they like.

For non-SoX stuff then there is more leeway & they can be helpful. Of course there are a auditors will use some discretion & point you in the right direction

Answer:
Unfortunately most auditors do not add value.


Just put a * into USR40 to cover all the theoretical eventualities...

Answer:
Unfortunately most auditors do not add value.


Just put a * into USR40 to cover all the theoretical eventualities...


Answer:
Auditors aren't there to add value. They are there to stop cavalier businessmen losing it.

Though personally, I think that forcing strong passwords simply forces people to write them down. And since most fraud is committed from withoin a company rather than outside it, writing things down somewhere around your desk is truly a Bad Thing.

Answer:
Auditors aren't there to add value. They are there to stop cavalier businessmen losing it.

Though personally, I think that forcing strong passwords simply forces people to write them down. And since most fraud is committed from withoin a company rather than outside it, writing things down somewhere around your desk is truly a Bad Thing.
There's a lot of truth to your assertion about the strong password stuff.
There is a study out there somewhere that covers the tradeoffs between enforcing stronger passwords and the likelyhood of people writing them down. Unfortunately I can't find a link

If I remember correctly, a reasonable compromise was forcing a minimum of 3 characters difference and having 1 number in there

Answer:
Passwords that are too strong can be as big a problem as weak passwords. They actually introduce two vulnerabilities.

1. (as noted) people write them down.
2. people forget them and call the help desk. Help desk password resetting is a critical weakness. If they have processes to validate users who are calling to get passwords reset, the process will bestrained if many people are having to call in.


My personal recommendation for an inside the firewall system is a seven character password that requires one number and one special character. I think that allowing people to cyclce passwords is fine. I think that USR40 should be set up with a few hundred gimme passwords (set up with wild cards) to prevent the most common issues. If you are really paranoid about security then there should be some process to monitor the use of invalid user ids (in STAT) and failed login attempts.

If you want to be any more secure than that then moving to three factor authentication with a security bolt-on is the best way to go.

USR12 Authorization values

Question: I'm trying to understand the authorization values field in USR12.

I can identify the field names that the authorization object is refering to, but am unsure what the other values are?

e.g.
M F0045C02ACTVT V02B06E09E23E43V60B61E65E78F0038C04TTYPE ECUSTEDTRAEMOVEETRAN

The field names are "ACTVT " and "TTYPE "

TIA

Answer:
You need the SAP code to decypher the "encrypted" code.


"M F0045C02ACTVT V02B06E09E23E43V60B61E65E78F0038C04TTYPE ECUSTEDTRAEMOVEETRAN "

In the record the leading 'M' means modified, the rest of the letters and numbers tell SAP what to do with the next set of numbers the 'F' is to define the field name, 'E' = Individual value
'G' Generic value
'V' beginning of interval, etc

The code to decypher this is
FORM READ_USR12 USING VALUE(OBJECT) VALUE(AUTH) VALUE(AKTPAS) RC.
DATA: INTFLAG TYPE I VALUE 0,
OFF TYPE I,
VTYP,
LNG TYPE I,
CLNG(2),
GLNG(2).
*
CLEAR USR12.
RC = 0.
IF AKTPAS = AKTIVATED OR AKTPAS = INWORK.
SELECT SINGLE * FROM USR12 "Expl. Aktiv- od. Pflegeversion
WHERE OBJCT = OBJECT
AND AUTH = AUTH
AND AKTPS = AKTPAS.
ELSE.
SELECT SINGLE * FROM USR12 "Wenn nicht, dann zuerst Pflege-
WHERE OBJCT = OBJECT
AND AUTH = AUTH
AND AKTPS = INWORK.
IF SY-SUBRC <> 0.
SELECT SINGLE * FROM USR12 "Nicht vorh., dann Aktivv. lesen
WHERE OBJCT = OBJECT
AND AUTH = AUTH
AND AKTPS = AKTIVATED.
ENDIF.
ENDIF.
IF SY-SUBRC = 0.
SETFILL = 0.
REFRESH TABSET.
CLEAR TABSET.
OFF = 2.
* Werte aufschluesseln und in die int. Tab. tabset laden
ASSIGN USR12-VALS+OFF(1) TO .
WRITE TO VTYP.
* Var. Teil bis zum FF (= Endezeichen) lesen
WHILE VTYP <> ' ' AND OFF < USR12-LNG.
OFF = OFF + 1.
* vtyp steht fuer Schluessel, ob es sich um Feldnamen, Einzelwert,
* Anfang Intervall oder Ende Intervall handelt.
CASE VTYP.
WHEN 'F'. "Feldname
OFF = OFF + 5.
ASSIGN USR12-VALS+OFF(2) TO .
WRITE TO CLNG.
LNG = CLNG.
IF LNG <= 0.
RC = 1.
EXIT.
ENDIF.
OFF = OFF + 2.
ASSIGN USR12-VALS+OFF(FLDLNG) TO .
WRITE TO TABSET-SFIELD.
OFF = OFF + FLDLNG.
WHEN 'E'. "Einzelwert
ASSIGN USR12-VALS+OFF(LNG) TO .
WRITE TO TABSET-VON.
IF TABSET-VON = SPACE.
TABSET-VON = ''' '''. "Blank als Value zugelassen
ENDIF.
APPEND TABSET.
SETFILL = SETFILL + 1.
TABSET-VON = SPACE.
TABSET-BIS = SPACE.
OFF = OFF + LNG.
WHEN 'G'. "generischer Wert
ASSIGN USR12-VALS+OFF(2) TO .
WRITE TO CLNG.
GLNG = CLNG.
OFF = OFF + 2.
ASSIGN USR12-VALS+OFF(LNG) TO .
IF INTFLAG = 0.
WRITE TO TABSET-VON.
WRITE '*' TO TABSET-VON+GLNG.
ELSE.
WRITE TO TABSET-BIS.
WRITE '*' TO TABSET-BIS+GLNG.
INTFLAG = 0.
ENDIF.
APPEND TABSET.
SETFILL = SETFILL + 1.
TABSET-VON = SPACE.
TABSET-BIS = SPACE.
OFF = OFF + LNG.
WHEN 'V'. "Anfang Intervall
INTFLAG = 1.
ASSIGN USR12-VALS+OFF(LNG) TO .
WRITE TO TABSET-VON.
IF TABSET-VON = SPACE. "Blank als Value zugelassen
TABSET-VON = ''' '''.
ENDIF.
OFF = OFF + LNG.
WHEN 'B'. "Ende Intervall
INTFLAG = 0.
ASSIGN USR12-VALS+OFF(LNG) TO .
WRITE TO TABSET-BIS.
IF TABSET-BIS = SPACE. "Blank als Value zugelassen
TABSET-BIS = ''' '''.
ENDIF.
APPEND TABSET.
SETFILL = SETFILL + 1.
TABSET-VON = SPACE.
TABSET-BIS = SPACE.
OFF = OFF + LNG.
ENDCASE.
ASSIGN USR12-VALS+OFF(1) TO .
WRITE TO VTYP.
ENDWHILE.
ELSE.
RC = SY-SUBRC.
ENDIF.
ENDFORM.
_________________
John A. Jarboe

Answer:
Thank you for that - that is exactly what I needed.

This however leads me to another question.

The code basically gives me something similar to table UST12.

I guess in part my question is, what to the "values" mean e.g.
09, 23, 43 for object field "ACTVT" and
CUST, DTRA, MOVE, TRAN for object field "TTYPE"

To give a bit more background in what I'm trying to do...
Given a transaction code (e.g.SE01) I'm trying to work out who is authorised to run the transaction. So if I run transaction "TSTCA" with a TCODE of "SE01" it returns two entries:

TCODE OBJCT FIELD VALUE
SE01 S_TRANSPRT ACTVT 03
SE01 S_TRANSPRT TTYPE



I can then go through a process of mapping the data through tables USR12->USR10->USR04->USR02 to find the authorised users, but I don't
understand is how authorisation objects returned by "TSTCA" map to authorisation objects in UST12 (or ultimately USR12). How do I test if a authorisation object in UST12 meets the requirements (other than object name and field names matching) - I guess the values have a meaning.

I know there are reports in SAP to do this for you, but I have to do this external to SAP through tables.

TIA

Answer:
TSTCA table is useless since the advent of authorization object S_TCODE in version 3.0. It is in effect a double tcode start check and the values should be deleted. You MUST have the access in the TSTCA table before the tcode will start and show the first screen, sam thing S_TCODE does.

UST12 is a "text" version of USR12 only desperatley wrought with errors. Unless you write a program to periodically sync the USTxx tables to the USRxx tble the data in UST12 is less than accurate and gets worse as time goes on.

THE ACTVT values are in table TACT and the ones applicable to the authorization object in question are in TACTZ.

Report RSUSR010 give you what you want, but it cannot tell you if the user can COMPLETE the tcode, only start it.

SU24 and a look at the user's role in PFCG will give you a 85% probability (Based on SAP delivered SU24) of whether the user can complete the tcode.

USR02 User Lock Value and CUA

Question: In table USR02, values for User Lock include value 16 for a number of users. I've never seen 16 (0, 64, 128, 32 are common).

We are using CUA so I'm guessing it has something to do with that.

Does anyone have any information on this? I need to figure out what this value means and whether these users are locked or not.

Thank you!

Olga

Answer:
Hi,

normally the value 16 in the table TACT means the authorization to execute which is treated by the sap during a run session. Did'nt find anything in sm31!

USR02 - UFLAG = 1

Question: In table USR02 we start having value 1 in field UFLAG. What does 1 mean ?
We know about 32, 64, 128, 192 but have no idea of 1. Anybody knows ?

Answer:
don't know, but anything other than zero means locked.
_________________
SapFans Moderator
NetWeaver ‘04–SAP Web AS for ORACLE certified

Search: /forums/search.php
SAP Notes: http://service.sap.com/notes
SAP Help: http://help.sap.com
Basic Rules: /forums/viewtopic.php?t=222759

Answer:
Surprisingly ID did not show "locked" in SU01. Have no idea what 1 is about.

usr tables display

Question: Is it possible to display tables which exceed the 1023 length error?

Thanks for any ideas.

Answer:
As I recall you can use SE17 which use to wrap the lines for you...It may still limit the field to 1023...One of those old IBM every thing based ont he 256 limits in the past.

Answer:
I already tried that but no luck.

You tried to display a table with a line width that exceeds the size of an SAP paging block (8K). This is not possible, since an internal table with the same dimensions as the specified table has been created. No more than one line of this internal table may be in a paging block.

USOBT_C corrupt??

Question: I will try to explain my problem as best I can.

In Dev 900 (Security development client) I am having a strange situation when I add a transaction to a role but only in a small number of occurences.

Open role > add transaction to menu > go to authorization tab (profile) to tweek the oject values. I am finding 2 situations to be strange.

1. As opposed to appending and object with additional values from USOBT_C in certain cases it's changing the original value.
Example -
S_ARCHIVE - Activity 03
Application Area - BC
Archiving object - Workitem

When I add a transaction that would call this object from USOBT_C - it should add an additional authorization as opposed to changing the original. Instead, it's overwriting the existing authorization with an activity 01

This is where it gets really strange to me which is situation #2 -Tthe transaction I'm adding to the role doesn't even call S_ARCHIVE in the USOBT table. I'm adding SE16 and everbody knows that calls only S_TABU_DIS and S_GUI.

So - Why is the table overwriting an existing authorization as oppsed to appending as it always does? Secondly - why is a transaction changing objects in a profile when the transaction has absolutely no relationship to said object in USOBT_C or for that fact, in the ABAP code although the code has no impact at this point?

Final observation - I have only noticed this happening in a few instances. In most cases, transaction/table/profile/authorization relationship works as expected.

Hope my example makes sense and I greatly appreciate any guidance.

Answer:
duplicate post locked.

USOBT_C corrupt??

Question: I will try to explain my problem as best I can.

In Dev 900 (Security development client) I am having a strange situation when I add a transaction to a role but only in a small number of occurences.

Open role > add transaction to menu > go to authorization tab (profile) to tweek the oject values. I am finding 2 situations to be strange.

1. As opposed to appending and object with additional values from USOBT_C in certain cases it's changing the original value.
Example -
S_ARCHIVE - Activity 03
Application Area - BC
Archiving object - Workitem

When I add a transaction that would call this object from USOBT_C - it should add an additional authorization as opposed to changing the original. Instead, it's overwriting the existing authorization with an activity 01

This is where it gets really strange to me which is situation #2 -Tthe transaction I'm adding to the role doesn't even call S_ARCHIVE in the USOBT table. I'm adding SE16 and everbody knows that calls only S_TABU_DIS and S_GUI.

So - Why is the table overwriting an existing authorization as oppsed to appending as it always does? Secondly - why is a transaction changing objects in a profile when the transaction has absolutely no relationship to said object in USOBT_C or for that fact, in the ABAP code although the code has no impact at this point?

Final observation - I have only noticed this happening in a few instances. In most cases, transaction/table/profile/authorization relationship works as expected.

Hope my example makes sense and I greatly appreciate any guidance.

For reference we are on Enterprise 4.7.

Answer:
Use the overiview Icon for the object being overwritten. When you add a tcode SAP sets the "read old merge new" ( which you sould be using on every entry to a standard rolel and when it does this it evaluates EVERY tcode not the one you added. You may find the object being changed is in accordance to the configuration of SU24 for an unrelated tcode...

I would say, working as designed...with one exception, there is a kernel patch and upgrade that will cause PFCG to destroy all your roles. You must go tothe next patch.

Answer:
Thanks John,

Any idea on the specific kernel patch. The reason I ask is that I did notice the last support pack Basis put is is when this problem began. In our training environment which is not on that support pack, I can't duplicate this problem which did lead me to believe that may have an impact.

Thanks for the comments.

Answer:
I beleive there was a posting here a month or so back that has the specifics. I'm not where I can look it up... But when I get a change I will.

Answer:
I remember a posting from some one who bantered on about having your prod system on a higher patch level than your training system.

Maybe the problem is indeed training related?

Jaba

Answer:
Thanks Jaba but in our case, it's not a training issue. The training box (separate instance) is the only place we do not have the issue and that may be because it's on an older patch level. Our production landscape - Dev>QA>PRD is on a higher patch level. Right after Basis installed the support pack is when we noticed the issue. Prior to the current support pack, our production landscape was on the same kernl patch as what the training box is on now and it worked fine then.

That's why I'm interested in learning of the kernl patch John mentioned that could cause PFCG to do strange things.

thanks for the responses.

Answer:
HogFan . i beleive with Basis support 48 the condition shows up. see OSS Note 679050 for details.
_________________

USO... tables - new 'Best Practice' system

Question: We have a newly built sandbox system (start of project) and I was assuming I would have to go in to SU25 to do the steps to populate the USOxx_C tables. (I’ve never been on an implementation from scratch so never done these steps myself before). However these are already 'somewhat' populated.

As it is a system migrated from SAP’s best practice system this probably explains why this is already done. However, when I look at the content of USOBX versus USOBX_C there is a difference on the number of entries. USOBX has 359,370 entries -30,000 more than the custom one.
USOBT has approx 190k - 60,000 more than the custom one.

Is this an error on SAP’s best practice system?
Should I run SU25 steps anyway?

Answer:
Does anyone have any input on this query?
I've just had a look at SU25 and step one was done in Jan 2005 and Step 2 in May 2004 ?

Answer:
Sorry to bump this up again but I have performed the SU25 step 1 in our sandbox system. The no of table entries are still not in sync, although there is less of a difference between the two.

Has anyone who has completed SU25 step on a system been able to confirm that, after this step, the no. of entries in the custom table matches the standard SAP one?

Using Text IDs as part of Authorization Profiles

Question: Hi,

I would like to disable specific header texts for input in VA01/VA02 based on a user's profile.

In SAP Help, it mentions that Text IDs can be used in determining the authorization of the user toward a particular text.

I would like to inquire how this can be done to achieve the input disabling of header texts?

Thank you
_________________
My ABAP Program does what I tell it to do... not what I want it to do...

Answer:
Not sure if this helps.

Specify that the user can create/change/display text_ids starting from a certain string or pattern say 001xxx or FINxxx.

However this assumes the user has to select the text id. Otherwise, the program has to check the user has the authorization for the pattern.

Answer:
thank you for taking time to reply.

unfortunately, the text id part of the Header Text in the Sales Order (VA01/VA02) so the user cannot select the text id nor could we find a user-exit where we could control this.

would there be any other solutions to this?

thanks
_________________
My ABAP Program does what I tell it to do... not what I want it to do...

Answer:
You cannot, it is not a control attribute for VA01/VA02.

Using STAD

Question: I want to run a report on a particular user using STAD but I can not get stats past two are three days. We are running mySAP ECC v7.0. What config might we have to do. I'm thinking there hasn't been anything done since the upgrade to the report. I've read some of the past post but nothing seems to work. Your help is most appreciated.

Answer:
STAD will not get you past that limit due to the restriction on the size of the file which starts writing over itself once its full. For longer term solution, try the security audit log.

Answer:
You can run ST03 or ST03N to see more data. THe drawback is the data is summarized and if you want detailed data STAT will show you very detailed data but only for 24 hours. It is then summarized into the MONI files which ST03 uses. SAP weeds out several tcodes from STAT and summarises the data as it transferes it to MONI.

MONI is further summarized into weekly and monthly data as the files get older.
_________________
John A. Jarboe

Answer:
I hate to sound like a neophyte, but since our upgrade to ECC 7.0, can you provide me with some instrux as to navigate through ST03N. STAT is no longer available in the new version and the MONI table does not tell me the information I need like what user took what tcodes on what day or I just don't know how to read it or translate it. By which, my second question is how do you translate the MONI table?

Answer:
Not sure about ECC 7.0.

But in ST03N, you can switch to Admin, then in Analysis Views, goto User Profile and double-click individual users.

Then you get Single Records which ultimately point to STAT but not sure about your version.

MONI table has fields in RAW so unsure how to translate it.
_________________
Suril

A conclusion is simply the place where you got tired of thinking.

Answer:
The problem stays the same even if you go through ST03N and go to single records. Since the data is ultimately pulled from STAD, you will be able to go back about 24 hours only.

Answer:
Historically ST03N reads the summary tables and you have to tell it the time period to look at. The default may be the current day. Up to 4.7 ST03 was fed from the STAT file which could alse be read using tcode STAT. THe STAT file was condensed and put in the MONI table. Since the record is a record of tables you cannot view it in MONI, but must use the function modules ST03 uses to read the file.

Using ST01

Question: I'm trying to run an authorisation check using ST01: I've done the following

authorisation check: Ticked

General Filters: entered username & transaction

Saved settings and turned on the trace and then asked the user to run through the transaction.

Then I've switched off the trace and gone to trace analysis, removed the times selected execute and the trace display screen show no results.

Help!! has my trace run??

Answer:
Did you check the 'Write to disk' option ?(under Write Options on 4.0b)

Answer:
Thanks...I'm using 4.7 so the path to follow is:

Edit>settings>write to database

Answer:
Hi

Did our read worked from the database. For some reason when I do this my log file is empty. I've used the write to disk option in 4.6B and now on Enterprise I connot get my file if I use Write to database.

Using SSO with ECC5 and password rules

Question: Does anyone know if we use Single Sign On (SSO) with ECC 5.0 the password rules would still apply?
My doubt is for instance if the minimum password lenth is set to 6 in RZ10 and the I have activated the system parameter logon/password_change_for_sso to have a value of > 1 does all the password rules apply for LDAP password

Answer:
I would like to add the following to your question...

Is it advisable to set the password rules in SAP for a single sign on environment, for that matter even the auto logout parameter, because ever if the SAP kicks the user out after inactivity and anyone can double click on the logon pad and misuse the authorizations if someone forgets to lock his computer?

Is it advisable to leave everything to LDAP and set the rules there rather? Wouldnt it add extra confusion for the users if we set different password rules in SAP? I am thinking parameter logon/password_change_for_sso provided by SAP to give flexibility incase we want to enfore more rules but the question is "is it necessary?"

using smtp sendmail from SAP

Question: Hi

Apologies all, I know this subject has been brought up earlier, I just havnt got it yet.

I am trying to simply send out emails when workitem item are received. I can config sapConnect. It is the RFC connection i have a problem with. I have the IP address of the SMTP server,
Activation Type - start
Start on Explicit host (I had the SMTP IP address here as target host)
what is the program name, I thought it would be SENDMAIL.

I am told by the people who look after the SMTP box that sendmail should be on the SAP box ????, so how do I config the rfc connection should this just point to the sap box which has sendmail service running on it, do i not need the SMTP server

I am confused - any help would be very welcome.

Thanks

John

Answer:
RFC connection should point to mlunxsnd program located in your /sapmnt//exe directory

Answer:
Thanks for the reply

Does that mean the RFC connection shouldnt be config'd for an another explicit host, but for the SAP box itself?

John

Answer:
Thanks for the reply

Does that mean the RFC connection shouldnt be config'd for an another explicit host, but for the SAP box itself?

John

No, mlunxsnd can be also installed as an RFC-Server and could be placed anywhere in the network. The TCP/IP-connection than has to be switched to register.
There is a note in OSS about this.

Answer:
dude, check the standard R/3 documentation CD... There is step by step instructions in there explaining how to set this up. RTFM !!!!

Using SAP shortcuts

Question: When opening an SAP shortcut from my desktop...

SAP says that, if a session is running, then it will directly start the task you want to run... (http://help.sap.com/saphelp_erp2005/helpdata/en/c0/732e42e1ef5633e10000000a155106/content.htm)

But when I open the shortcut, it pops up a password window everytime, no matter how many sessions are open at that time.

Why is this? Am I missing something or is it a bug?

I am using SAP 4.7, GUI version 620.

Thanks,
Juwin.

Answer:
not a Security question.
_________________