Mass user password reset

Question: Hi

We are building a SAP landscape, the DEV & QA systems have been built, the DEV has been in use for the last few months, we are just about to start using QA for IST testing, we had about 100 users created in DEV & QA at the same time, the QA users haven't been used in the last few months, so I would like to reset the passwords for the 100 QA users, I can only reset individually in SU01, SU10 for mass changes doesn't appear to allow for changing passwords, is there anyway within SAP to reset passwords for mass users, in the past I've used CUA but we haven't got that here, and i'd rather not do it via SQL.

We are running NW04 on Windows 2003/MS SQL server.



Answer:
create a SCAT (test tool) were you make UID and pasword a variabla so you can upload from a spreadsheet any value you want

Mass user deletes in 40B

Question: Is there a way in 40B to do a mass user delete? Entering SU01 and then choosing Environment, Mass Changes, Delete All Users is not something I do not want to do.

Can I delete by user groups? If so how is this done?

Is going into SU01 the only option I have?

Thanks

Answer:
maybe su10

Mass User Creation

Question: Can anyone tell me how to create users in mass? They will all use the same profile. I have already generated their usernames. So everything except their names will be identical. Any help would be appreciated.

Answer:
The best way I have found is by creating a CATT.
A CATT will record your actions, in this case creating a user ID, and by using an input file will make this manual process much easier.

Look up documentaion in the SAP glossary on CATT.
You need to first record what you want SAP to do, use transaction SCAT.
In SCAT you record going into SU01 creating the users etc.

Then as the doc will show you, you need to input for the CATT the fields you want to use as varialble, (ones that will change user to user) like a user ID.

Then you populate the export file that the CATT creates, enter all your data and run it.

Good luck!

Answer:
An alternative is the standard transaction SU10 which works greatly except the following:
1. I experienced that the function to remove roles from users does not work properly.
2. All passwords are automatically generated (you see them if you ask for a log). If you want to give the same password or at least a non-generated to all, you have to reset that manually.

Answer:
LSMW is another easy tool to create mass users.

Mass Transport of Derived Roles

Question: Hi All,
I was wondering if there was an easy way of actioning one mass transport of an imparting role and all of its derived roles in one go. At present I have to create the transport and attach each role individually to it, which is fine but time consuming.

From PFCG, then in the transport screen there seems to be an option to attach other roles, but it will not allow me to add additional roles to the transport. Is there a way of doing this?



Answer:
Use the mass transport functionality from PFCG. Then you can add using wild-cards (*)


Pfcg - Utilities - Mass Transport

Mass transfer of User Master Record from PRD to TRN in CUA

Question: Hi Gurus,

Is there any way that I can do a mass maintenace of user master records in CUA? I would like to transfer whatever roles the users currently have in PRD to TRN. Is there a quicker way for me to do this than manually??

I would really appreciate any feedback.

Regards,
Lynne

Answer:
Perhaps eCATT and a temporary beefing up of your CUA system user if required?

Tarr

Answer:
You will never get all the correct tables to transport the user master record and if any IDs exist in the target system the IDs will get messed up and workflow will not work properly. Re-create the ids from an excel list.

Answer:
Hi John, Tarr...

That's exactly the problem... These users already exist in the training client and even if we do a client export ' User Master and Auth profile' from PRD to TRN it eventually gets overwritten with the data in CUA

I'll try changing the global settings in CUA to exclude TRN, do the export, sync with CUA and change the settings back, will let u know whether successful or not!!

Mass Transaction Add

Question: Hi there, running 4.7, and have a requirement to add a transaction to approximately 60 roles.

Can this be done in a mass job rather than having to edit and manually add the transaction to each role?

Values and generation won't be a problem, as I can do this using the "Mass Generation" list, it's just the transaction addition that's causing me the headaches

Cheers,

Grimster.

Answer:
SAP had one at one time, the problem is adding the tcode is NOT sufficient . It should be added to the menu ( which Manipulating AGR_TCODES will do) so SU24 info is brought into the role. However the ONLY way to get the authorization associated with the code is to OPEN the role and use expert mode on the auth tab and "read old, merge new". THere is no SAP program that does this and you may have to resolve the "yellow" lights to get therole to work. So I would use SUPC to generate a worklist and use the "role button " to enter the role to add the tcode in the menu and then maintinat he auths.

Mass removal of users from reporting user groups

Question: Hi,

Not sure if this is the right place to post this but here goes.

We've just upgraded to ERP2005 and as part of it we are wanting to tidy up our reporting user groups and infosets.

What I need to do is remove users on mass from user groups.

Any ideas?

Dom
_________________
Dom

Answer:
If you are talking abt the user group on the "Groups" Tab in SU01, you would need to use SU10 to do that

Answer:
Not as such I don't think I don't have authorization to maintain either of those.

I'm talking about assigning users to reporting user groups and infosets with relation to using ad-hoc and SAP query.

I've actually gone through by hand now and removed all users from the reporting user groups expecting that this would remove access to the queries associated with them.

Unfortunately this is not the case and users appear still to be able to view and run queries even without being a current member of the relevant reporting user group.

Our ultimate aim is to remove access to the mess that is the current infosets and user groups and create a new reporting structure without having in the short term to have to delete all existing queries in case users require us to recreate them for us.

Any help as to how to do this at all would be greatly appreciated.

Dom
_________________
Dom

Answer:
For the record it's transaction SQ03 I'm using to maintain the user groups and infosets.

Mass 'Read Menu' in composite role

Question: Hello everybody !

When changing a single roles ( adding or deleting a transaction ), I have to go on each related composite role, one after the other, and 'read menu' to update menu.
Is it possible to process a mass 'read menu' , for many or all composite roles ?
Thanks
Laïla

Answer:
Did you already find a solution?
_________________
Kind Regards/Vriendelijke groeten/Amicalement,
Wim

Answer:
Yet another reason NOT to use composite.
I believe you are stuck with updating it manually, though you can look at the where-used on SSM_CUST to see if there is a "menu" cofig to update the menus whne you make a change.

SUPC may also be of help in going through each role.

Answer:
Ok John, apparently you're not in favor of using comp.roles.
But IT is standard SAP and therefore there should exist a way to automate that. (why would SAP have Mass generation, mass transport, mass user compare, mass download-upload ==> but NO mass redesign of menu?

Does anyone have ever used following entries in SSM_CUST:
PROCESS_MENU_PFCG
Z_EXIT_USER_COPY
POSTPROCESS_MENU
SSM_FORCE_MENU_LOAD

Are they useful?
_________________
Kind Regards/Vriendelijke groeten/Amicalement,
Wim

Answer:
Hello everybody ,
Thanks for your answers, but i didn't find yet a solution !!
I keep on searching...
Laïla

Answer:
I personally just wrote an abap to do this, not hard.

Answer:
There are a lot of things available in SAP and they are there to address a symptom instead of having the customer address the underlying cause of the problem, POOR Security design.
There is no automated tool SAP provides to update the menus. there is no warning to prevent a user from wiping out any changes in the child role when the "adjust" path is taken in the Parent. The list goes on... just because it is in SAP does not mean it SHOULD be used, Above all in ANY installation on ANY Module KEEP IT SIMPLE, composites are NOT simple and assumes a level of sophistication and full understanding of the consequences of choosing that path.

If your organization and others complain enough SAP will provide anothe "cure" for the symptom, rather than tell you to redesign your security and charge you for it....

Answer:
We have checked all messages posted regarding mass gerneration of menus in composite roles. (i.e. transaction PFCG).

We tried using CATT script but this didn't work.

Now we are trying to develop our own ABAP program to replicate
the READ MENU, SAVE in PFCG for a composite role to regenerate the menu.

We are finding this difficult to replicate due to the amount of SAP standard function modules and FORMS within function groups that the program is executing. Can you provide us with any particular hints or ideally source code that has been developed to overcome this problem.

Mass Password Reset

Question: Hi All,

Is there a way to mass reset the password of about 100 users at the same time. or do i have to write a script to do this



Answer:
Hi,

I use a CATT script to do this.

Mass Maintenance Transaction Availablity

Question: I am fairly new to SAP Security and would like some input to the use of the "MASS" transaction and any subsequent spin off's. As present the business would like the use of MM17 - Material Mass maintenance and i am in discussions if this should be made available to the business. Is this a transaction that should be available for daily use or should it be restricted to anyone in particular. Also what if any are the disadvantages of having this access is data integrity.

Answer:
Mass maintenance transactions are generally OK if assigned to the correct person. Typically a transaction like MASS would be assigned to someone in a business support function (such as Master Data Owner/Superuser) and are used periodically. If they are required on a daily basis then there may be a business process problem.

The main risk is that mass maintenance of anything allows a large number of changes to be made. It only takes one mistake to damage a large amount of master data. This risk can be mitigated a bit by restricting object type via object B_MASSMAIN - this can force users to only update certain data areas e.g. Purchase Orders, Sales Orders etc.

Mass Maintenance of User Groups

Question: we redesigned our Usergroup-concept. is there a quick way (report,...) to maintain ethe usergroups ? For me the use of transaction SUGR is a little bit exhausting.
because i have to delete lots of entires and create new ones.




Answer:
You can write a program but its probably faster to just use SUGR