SAP Security Interview Questions

What is short dump and what do you do with it?

Short Dump is nothing but the abap dump which gets displayed when the error occurs. It gives us the log to rectify or fix the problem so that we can move forward in our process.When we see the short dump it gives us the complete solution also which is one of the possible solutions. So by seeing the log we can go to the particular as guided in that log and can fix the problem.

How can I able to see that t_code in the user menu?
I created a role with some t_code and I assigned it to the user. Then again I change the role with adding one more t_code. When I login to the user the user menu is showing only the first t_codes. It is not showing the later T-code which I added. But the t_code is working.

Check the following:

1. Click on the 'Menu' tab and check for the t-codes assigned.
2. If you still find the old t-codes, remove them.
3. Add the new T-code.
4. Save the role.
5. Click on Authorizations Tab., and check S_TCODE.
6. Save and Generate.

Than assign them to the user and perform "user comparision" and "complete comparision".

What are the different ways to find who has deleted the data in table?
Today I got a complaint from functional team that all their material master data in MARA and all related tables such as MARC, MARD, MBEW got deleted. They want to know who has deleted the records and also tcode executed.
I had executed tcode *stad* and gave list of transaction codes exeucted from last 24 hours. Still they are unable to find who has deleted the data. No entry in system log is available.

Anyone, who's able to write ABAP programs, has full access to the database and thus can delete all the data.

Additionally users with permission can use SE14 to delete table contents completely.

It's hard to find out what happened, if not impossible :(

How to improve system performance?
If users have opened more sessions and no transaction is running and there are many users who have opened more that 2 sessions and left that as it is.
How to control those idle sessions?

You can control your users by changing the following in your System Profile parameter ( tcode RZ10).

rdisp/max_alt_modes ---> controls the number of sessions a user can have at a time.
rdisp/gui_auto_logout (optional) --->This is the time the system will wait in seconds for inactive users to automatically logoff in SAP

ST02 / ST03 In general via table buffers, you could go into the whole Work Process, roll in, roll out, heap (private) memory, etc. however just as a Unix or DBA admin would know, is you look this up when needed for the exact specifics.

Ask him/her to describe where they would look at the buffer statistics, and what steps they would use to adjust them?

ST02, RZ10

Ask him/her to describe how to setup a printer in SAP or where they would look to research why a user/users can not print?

SPAD, SP01, SM50, SU01

==============

Keep the interview to 3 general areas:

DB (what is the directory structure/ where are the files kept oracle alerts, init.ora, redo logs, archive logs, etc.; possibly some basics stuff like what to do "high level" when the archive directory fills up, etc. Keep this minimal as from a SAP basis admin point of view Oracle is just a big giant bit bucket and SAP can handle to the daily monitoring and maintenance itself.

OS (what is the directory structure (what is NFS mounted and why / where are the message files contained for the OS error log; basic commands for the OS eg. Unix, mv, cp, ls, grep, ps-ef, df-k, etc. That is pretty much all the SAP basis admin will need to know. Client/Server architecture.

SAP (what is the directory structure / where are files located ie. profiles - start, instance, default (what are they and what is the order of precendence) start is for statup only, instance is the first to be read then the default and if a given parameter cannot be found in the instance or then the default then the internal standard is taken from RZ10 setting.

You can ask them to ran Transaction codes to you. Menus constanly change so go with T-codes. He should have a good knowledge of the following areas; transports, user / print / spool / batch management, monitoring, client tools and copies, support packages, kernel patches, workload analysis, Roles and Security, etc.

The standard list of t-codes is pretty much

SM50, SM51, SM66, SM12, SM13, SM21, DB01, DB02, DB13, ST01, ST02, ST03, ST04, ST05, ST06, SU01, SUIM, PFCG, SCC4, SE01, SE09, SE10, SPAM, SM35, SM36, SM37, SPAD, SP01 SCC3, SCCL, SCC9 this are pretty much you heavy hitters for monitoring and support.

I would ask in general how he would troubleshoot the following:

- User cannot connect to SAP

check SAP logon settings, ping the host, check message server, check dispatcher, etc.

- User cannot print

check SAP user setup, check SPAD, check spools, check unix queue or print queue at the os level, etc

- System seems slow

check SM66, SM51, SM50, SM21, ST06, ST03, SMLG, AL08 etc.

Some important things to remember is to ask not get specific to your installation or specific system setup as all SAP instances are different, keep your question to general topics and general answers.

The most important thing to notice when choosing a candidate is not how they parrot back answers to you, but if they can
a) think for themselves and
b) they actually like to and will keep on learning as no one knows it all and
c) they have a good background and willingness to perform analyis and will keep on digginging until the answer is found or until their resources are exhausted and then they will pull in what is required to figure it out.

SAP BASIS Backup Interview Questions

Your Company’s Take on Backups
Backup and recovery for a SAP instance is best handled along with the other
backup and recovery needs of your company’s computer systems. But for those company’s who do not yet possess a solid backup and recovery solution, or who simply want to segragate the SAP landscape from all other internal IT solutions, here are a few things you need to know.
Online versus offline, high availability, frequency, are all decisions your IT staff need to make based on their history with similar procedures at your company, the recommendations of SAP, and the guidance of your implementation Basis consultant. Enforced backups, and detailed and tested recovery procedures should be part of any Disaster Recovery plan, and a documented part of any SAP implementation project.
If your company falls into the latter category, SAP does supply tools for your uses which can be used in either line command form or from within the SAP instance. If you SAP server contains a tape drive or has access to the network tape unit, transaction DB13 can be used to schedule periodic backups. This is the same transaction where weekly statistics, log cleanup, and database verification jobs are scheduled in the post-installation work after installation of a new SAP instance. DB13 scheduled BRCONNECT runs which can also be CRONed in command line form by the IT staff.
For more information, please see the SAP Online Documentation for DB13 by going to the DB13 transaction and clicking Help -> Application Help or referring to the section Creating Database Statistics, Index Rebuilds, and Log Backup Jobs – Oracle. More information regarding BRCONNECT can be found in the SAP BRCONNECT Guide which can be found at http://service.sap.com/instguides.

What Needs to Be Backed Up?
The PRD Instance
Daily backup should be made for these SAP specific directories:
/usr/sap/
/sapmnt/
/usr/sap/trans on the TMS Domain Controller Server
Any directories containing flat files that are used by the SAP instance
Daily backups should be made for these Oracle specific directories:

/oracle
Directory holding redo logs if not in the /oracle structure
Weekly backup should be made for these OS specific directories:
Root
/etc
/dev
For Oracle, the entire /oracle directory should be backed up daily if there is only one Oracle Instance on the server, and each separate /oracle/ directory if there is more than one instance on the server.
It is also recommended that a full offline image of the entire server be made before the monthly closing cycle.
The DEV and QAS Instances
Weekly backup should be made for these SAP specific directories:
/usr/sap/
/sapmnt/
Any directories containing flat files that are used by the SAP instance
Weekly backups should be made for these Oracle specific directories:
/oracle
Directory holding redo logs if not in the /oracle structure
Monthly backup should be made for these OS specific directories:
Root
/etc
/dev
For Oracle, the entire /oracle directory should be backed up daily if there is only one Oracle Instance on the server, and each separate /oracle/ directory if there is more than one instance on the server.
It is also recommended that a full offline image of the entire server be made at the same time every month.

Working with saprouter
Starting saprouter (OSS Link)
1. Log on to the appropriate server as adm.
2. Click Start → Administrative Tools → Services to open a Services window.
3. Right-click on the SAPROUTER service and click Start.
4. You may now log off the server.

Verifying the Status of saprouter

If you have previously successfully established SAPNet (OSS) communications with SAP via saprouter in the past, there can only be three reasons for a “broken” SAPNet connection to SAP: the SAP VPN is down (which rarely happens); your saprouter configuration has been incorrectly changed (also very rare); or your saprouter is not running (happens all the time).
1. Log on to the appropriate server as adm.
2. Click Start → Administrative Tools → Services to open a Services window.
3. Look at the SAPROUTER service. If is not started, right-click to start the service. If it is started, right-click & Stop the service and then right-click & Start the service. This should “bounce” your saprouter instance.
4. You may now log off the server.
Return to Index...
Stopping saprouter
1. Log on to the appropriate server as adm.
2. Click Start → Administrative Tools → Services to open a Services window.
3. Right-click on the SAPROUTER service and click Stop.
4. You may now log off the server.

SAP BASIS System Interview Questions

Creating System Parameters
6. Log on to any client in the appropriate SAP system.
7. Go to transaction RZ10.
8. On the Edit Profiles screen, select the _DVEBMGS00_SAP Profile from the dropdown, or whatever instance profile you need to change. In the Edit profile section, click the radio button to the left of Extended maintenance. Click the Change button.
9. On the Maintain R/3 Profile screen, click the Add Parameter button.
10. On the next Maintain R/3 Profile screen, type in the new Parameter name and Parameter val. Click the Copy button. Click the white arrow on green picture-icon twice.
11. On the Maintain R/3 Profile popup, click the Yes button to save your changes.
12. On the Edit Profiles screen, click the Save picture-icon.
13. On the Save profile popup, click the No button.
14. On the Activate profile popup, click the Yes button.
15. On the Edit Profiles popup, click the green √ button.
16. On the Caution! Caution! Caution! popup, click the green √ button.
17. If you receive a Possible Inconsistencies in OP Modes screen, double click over the unless you are unsure of why this message has been displayed.
18. You will not get a confirmation message. You may now leave the RZ10 transaction.
Return to Index...
Modifying System Parameters
1. Log on to any client in the appropriate SAP system.
2. Go to transaction RZ10.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
3. On the Edit Profiles screen, select the _DVEBMGS00_SAP Profile from the dropdown, or whatever instance profile you need to change. In the Edit profile section, click the radio button to the left of Extended maintenance. Click the Change button.
4. On the Maintain R/3 Profile screen, locate the parameter that needs to be changed in the Parameter name column. Change the matching value under Parameter value to the new value. Click the Copy button. Click the white arrow on green picture-icon.
5. On the Edit Profiles screen, click the Save picture-icon.
6. On the Save profile popup, click the No button.
7. On the Activate profile popup, click the Yes button.
8. On the Edit Profiles popup, click the green √ button.
9. On the Caution! Caution! Caution! popup, click the green √ button.
10. If you receive a Possible Inconsistencies in OP Modes screen, double click over the unless you are unsure of why this message has been displayed.
11. You will not get a confirmation message. You may now leave the RZ10 transaction.
Return to Index...
Deleting System Parameters
1. Log on to any client in the appropriate SAP system.
2. Go to transaction RZ10.
3. On the Edit Profiles screen, select the _DVEBMGS00_SAP Profile from the dropdown, or whatever instance profile you need to change. In the Edit profile section, click the radio button to the left of Extended maintenance. Click the Change button.
4. On the Maintain R/3 Profile screen, locate the parameter you need to delete and click on the Parameter name to high-bright it. On the top-most menu bar, click Parameter → Delete.
5. On the next Maintain R/3 Profile popup, make sure that the parameter listed is the one you need to delete. Click the Yes button to delete the parameter. You will receive a Parameter was deleted message in the status bar at the bottom of the screen. Click the Copy button. Click the white arrow on green picture-icon.
6. On the Edit Profiles screen, click the Save picture-icon.
7. On the Save profile popup, click the No button.
8. On the Activate profile popup, click the Yes button.
9. On the Edit Profiles popup, click the green √ button.
10. On the Caution! Caution! Caution! popup, click the green √ button.
11. If you receive a Possible Inconsistencies in OP Modes screen, double click over the unless you are unsure of why this message has been displayed.
12. You may now leave the RZ10 transaction.
Return to Index...
Overview of All Work Processes Running on a SAP System
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SM50.
3. On the Process Overview screen, all processing threads for the SAP system are displayed. If a thread is being used, the name of the report running will be displayed as well as the number of seconds that the report has been running, the client in which the report is running, the action the report is currently doing, and, if applicable, the table the report is currently accessing.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
4. Click on the blue arrow circle picture-icon to refresh the process data appearing on the screen.
5. Click the white clock picture-icon to display the amount of CPU time consumed by each process thread so far.
6. Double click any display line containing a report name in order to see more detailed information about the running report. This information includes database access statistics and timings. Use the white arrow on green picture-icon to go back to the Process Overview screen.
7. Click on any process thread and then click the blue cylinder with glasses picture-icon. This will display the Trace Data screen which shows the actual communication between SAP, the operating system, and the database server. This information is useful when tracking process thread problems. Use the white arrow on green picture-icon to go back to the Process Overview screen.
8. You may now leave the SM50 transaction.
Return to Index...
Stopping Run-Away or “Bad” Work Processes
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SM50.
3. On the Process Overview screen, find the process which must be
stopped. Place a √ in the □ to the left of the process number
to be stopped by pressing Space. On the top-most menu bar,
click the Process → Cancel without core.
4. Click the blue arrow circle picture-icon to refresh the Process
Overview screen until the stopped process has cleared from the
display.
4. You may now leave the SM50 transaction.
If this does not kill the process, you can go to transaction SM04 and kill the user’s session. If this does not kill the process, you can log on to the server, open a Task Manager session, and End the Process. If this does not kill the session, there is an executable in the RUN directory on the server called sapntkill.exe. Run it providing the process ID number. If none of the above work, you have no choice but to “bounce” the SAP instance and/or possibly the serve.
Return to Index...
Increasing or Decreasing the Number of Work Processes
1. Log on to any client in the appropriate SAP system.
2. Go to transaction RZ10.
3. On the Save profile popup, click the No button.
4. On the Edit Profiles screen, select the _DVEBMGS00_SAP Profile from the dropdown, or whatever instance profile you need to change. In the Edit profile section, click the radio button to the left of Extended maintenance. Click the Change button.
5. On the Maintain R/3 Profile screen, locate the dialog processes rdisp/wp_no_dia line in the Parameter name column. Change the matching value under Parameter value to the new value. Click the Copy button. Do the same for the batch processes, rdisp/wp_no_btc, and the update processes, rdisp/wp_no_vb. Be sure to click the Copy button after each change. When all the changes have been made, click the white arrow on green picture-icon.
6. On the Edit Profiles screen, click the Save picture-icon.
7. On the Save profile popup, click the No button.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
8. On the Activate profile popup, click the Yes button.
9. On the Edit Profiles popup, click the green √ button.
10. On the Caution! Caution! Caution! popup, click the green √ button.
11. If you receive a Possible Inconsistencies in OP Modes screen, double click over the unless you are unsure of why this message has been displayed.
12. You will not get a confirmation message. You may now leave the RZ10 transaction.

SAP BASIS Transport Interview Questions

Configuring TMS - Transport Management System - for the First Time
Note: if you already have a TMS configured, do not use this section to add a new instance to the existing TMS configuration. You could severely damage any pre-existing transports, making them untransportable. Instead, use the following section Adding New Instance to TMS Setup.
1. Log on to client 000 of the SAP instance to serve as the Domain Controller.
2. Go to transaction SE06.
3. Click on the Perform Post Installation Actions button.
4. Go to transaction STMS.
5. You should see a popup box with the title TMS: Configure Transport Domain. If the popup doesn't say that, press F6 to change to the correct popup box.
6. Fill in the TMS: Configure Transport Domain popup with the Description, Name of DOMAIN_, and the description of the Transport Domain. Then click Save.
7. On the Transport Management System screen (if you aren’t there, back out until you are), assuming that this is the first SAP instance and there are no other installed SAP instances in your landscape yet, and assuming that you want your transport requests to be transportable and not local only, click on Overview → Systems.
8. On the System Overview – Domain Domain_ screen, click SAP System → Create → External System. Fill in QAS if you are going to have a three system configuration or PRD if you are going to have a two system configuration, or make up a if you are never really going to have another SAP system. Fill in the rest of the information including the Path which is assumed to be \\:\usr\sap\trans for NT or /usr/sap/trans for UNIX. Click Environment → Transport Routes.
9. On the Display Transport Routes screen, click the User Settings button, turn “on” the Hiergraphical List Editor, and click the √ Continue button. Back out
This document is the intellectual property of Jo Spencer and may not be edited without permission.
of the screen and then go back in – you should see the list in a text mode which makes it easier to handle.
10. On the Display Transport Routes screen, click the Display<>Change button to toggle into Change Mode.
11. On the Change Transport Routes screen, click Configuration → Standard Configuration → Development and Production System.
12. Fill in the Development and Production System popup, using your current SAP system SID as the Development system and the SAP instance you created in step #8 as the Production system. Click the √ mark to Continue.
13. Back on the Change Transport Routes screen, click the Save icon and confirm all the popup questions.
14. On the Change Transport Routes screen, back out until you can once more see the Transport Management System screen. Click Overview → Systems.
15. On the Display TMS Configuration: System XXX screen, double-click the TMS Domain domain controller SAP instance.
16. On the Display TMS Configuration: System XXX screen, click the Display<>Change button to toggle into Change Mode. Click the Communication tab and make sure that the Transport Group Name is correct. It should contain of the Domain Controller in the format of DOMAIN_ where is the System ID of the SAP Domain controller. Use the dropdown to find the correct entry it the field is blank. Click the Transport Tool tab. Verify that the information on the tab is correct and click the Insert Row button. Add a Parameter of CTC and a Value of 1. Click the Save button.
17. Do step #16 for every system in your TMS Domain, making sure to change all Transport Group Names are the same and the CTC row is added to each with a value of 1.
18. Save your way back the the main STMS screen.
19. You may now leave STMS.
Return to Index...
Adding a New SAP Instance to an Existing TMS Domain Controller
1. Log on to client 000 in the SAP instance you want to add to the existing TMS
Domain.
2. Go to transaction SE06.
3. Click on the Perform Post Installation Actions button.
4. Go to transaction STMS.
5. You should see a popup box with the title TMS: Configure Transport Domain. Press F6 until you see a TMS: Include System in Transport Domain popup.
6. Fill in the TMS: Include System in Transport Domain popup with the Description, Target Host, and System number of the TMS Domain Controller then click Save.
7. You should see a message that says SAP System waiting to be included in the Transport Domain.
8. on to client 000 of the Transport Domain Controller and go to transaction
Log STMS, keeping your original session in the other SAP instance open.
9. On the Transport Management System screen, click Overview → Systems.
Highlight the System you just added and then click SAP System → Approve.
Then confirm all the messages.
10. Back on the Transport Management System screen, click Environment →
Transport Routes.
11. On the Display Transport Routes screen, click the Display<>Change button
to toggle into Change Mode. Click on Edit → Transport Route → Create.
11. On the Create Transport Route popup, use the Consolidation boxes to enter
the SID of the transport domain, create a Z* transport layer, and the SID
This document is the intellectual property of Jo Spencer and may not be edited without permission.
of the system you are adding. Click Save and confirm. Back out to the main
Transport Management Screen.
12. Back on the Transport Management System screen, click Overview → Systems.
Double-click on the new system, and click on the Communications tab. Make
sure that the Transport Group name is the name of the original transport
domain. If not, change it. Click the Transport Tool tab. Verify that the
information on the tab is correct and click the Insert Row button. Add a
Parameter of CTC and a Value of 1. Click the Save button.
13. You can switch back to the new instance, and confirm that the SAP System
waiting to be included in the Transport Domain has disappeard.
14. You may now log out of both SAP instances.
Return to Index...
Make a Local Transport into a Transportable Transport
Sometimes, mistakes just happen. For this example, we will use a transport
SM1K00047 as the erroneous change request. Make sure to release SM1K00047 before
beginning this procedure.
1. Log on to the client who is the owner of the local transports that needs fixed.
2. Go to SE03.
3. On the Transport Organizer List screen, click on Merge Object Lists which is
in the Requests/Tasks section.
3. On the Merge Objects List screen, put SM1K00046 in the first Request/Task
field. Make sure that the Released check box is "on" in the Request Status
section and click the Execute icon.
4. On the Merge Objects List screen, click on the Merge icon. 5. On the Enter Transport Request popup, click the Create Request icon. 6. On the Select Request Type popup, click "on" radio buttion Workbench Request. 7. On the Create Request popup, fill in the necessary information and make sure
that the fill in the Target field so that the transport request is NOT local. Click the Save, OK, √ icon, etc. until everything is done. You will
get a new transport request number, in our case SM1K00050. This new request
can be released using one of the transport organizer Transactions like SE10,
etc. Once it is released, you can go to /usr/sap/trans on the OS level and in
directory cofiles copy K00050.SM1 to K00046.SM1, and in directory data copy
R00050.SM1 to R00046.SM1.
8. You may now leave SE03.
Once you have control of your session again, the transports are done. Verify their return code in the Import Queue list. It shoud have been updated automatically.
Return to Index...
Transporting Change Requests
To manually transport change requests from DEV/QAS to PRD:
1. Make sure the change request(s) has been released via Se10 or one of the other Transport Organizer Transactions.
2. Go to transaction STMS and click Overview → Imports. Double-click the PRD queue.
3. Click the refresh button to make sure you have the most current view of the PRD queue. Make sure the change request(s) you want to transport shows in the queue.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
4. Using the F9 button, highlight all the transactions you want to manually transport.
5. Click on Extras → Activate Inactive Requests. Confirm the popup. This bypasses the STMS_QA process.
6. Leave the change requests highlighted. Click Request → Import. On the popup, make sure that the target is client 300. Make sure that Synchronous radio button is "on" in the Execution tab. Make sure that the first three options are checked "on" in the Options tab. When you are done, click on the green √ and confirm the next popup.
Once you have control of your session again, the transports are done. Verify their return code in the Import Queue list. It shoud have been updated automatically.
Return to Index...
Adding a Change Request to a Transport Queue
1. Make sure the change request(s) has been released via Se10 or one of the other Transport Organizer Transactions.
2. Go to transaction STMS and click Overview → Imports. Double-click the PRD queue.
3. Click on Extras → Other Requests → Add. Fill in the Number of the Transport Request to be added to the queue and then press Enter.
4. Confirm the Add Transport Request popup. The transport request should now appear at the bottom of the queue list.
Return to Index...
Viewing the Transport Queue History
1. Go to transaction STMS and click Overview → Imports. Double-click the queue for which you want to view the history.
2. Click on the Import History button or press Ctrl+F7. The resulting list can be sorted and filtered to produce a more exacting report if needed.
Return to Index...
Re-Transport Several Change Requests at Once
1. Go to transaction STMS and click Overview → Imports. Highlight the queue into which the transport(s) to be moved again were originally transported – the “FROM” queue - and click the Import History button or press Ctrl+F7.
2. If your SAP instance is older, you may have a very long Import History list in the next screen. Use some of the available filters and sort options to create a more controllable list of transports. Use the F9 to select and/or unselect as many as you need to transport.
3. Once all choices have been made, click Request → Forward → System. Fill in the “TO” system and click on the Execute green √ mark.
4. Now you can go to the “TO” queue and refresh the list. Your imports should all be there.
Return to Index...
Transport Tool System Confirmation
This document is the intellectual property of Jo Spencer and may not be edited without permission.
1. Go to transaction STMS and click Overview → Imports.
2. On the Import Overview screen, click Import Queue → Check → Transport Tool. You may get a message asking if you want to check the the transport tool for all systems. If only want to check a limited subset of the SAP instances, use F9 to select and/or deselect those systems before you click Transport Tool.
3. On the TMS: Check Transport Tool screen, a list of all selected SAP instances to be checked will appear.
If you see any thing but red green Oks, expand all the lines with the non-OK marks and look for more information. Correct these problems and then run this report again until it comes back clean.
Return to Index...
Use Target Groups to Transport to Mulitple Clients in Two Different Instances
1. Log on to client 000 of your TMS Domain Controller SAP Instance.
2. Go to transaction STMS.
3. On the Transport System Management screen, click Overview -> Transport
Routes.
4. On the Display Transport Routes screen, click the Display<>Change button to
toggle into Change mode. Click on the Target Groups line and click the
Create button.
5. In the Create Transport Group popup, fill in the Target Group as /XXXCLNTS/,
give a Short Description and click the Client Assignment button. Be aware
that the Target Group name must start and end with a “/”.
6. Enter each Target system and Target client you need. For our example, we will
DEV 100, QAS 200, and QAS 210. Click the green check mark to Transfer. You
now have a target group. Now you must create a Consolidation Layer.
7. Back on the Change Transport Routes screen, click on Transport Routes and
click Create.
8. In the Create Transport Route popup, click the Extended Transport Control
button at the bottom of the popup. Make sure Consolidation is "on" and fill
in the information using our Target Group as the Consolidation Target.
9. Click the green check button to Save the change.
10. You now have a Transport Group. Confirm the Disturbution of it to the other
SAP Instances.
Return to Index...
Configure TMS to Use SAP's Quality Assurance Functionality
A Quality Assurance system must have a) a delivery route leading from it to
another instance, and b) be the target of a consolidation route. See topic
Using Target Groups to Transport to Mulitple Clients in Two Different Instances
to fulfill the a) requirement.
1. Log on to client 000 of your TMS Domain Controller SAP Instance.
2. Go to transaction STMS.
3. On the Transport System Management screen, click Overview -> Transport
Routes.
4. On the Display Transport Routes screen, click Display<>Change button to
toggle into change mode. Click on the instance in which you want to control
QA. Normally, this is QAS and the instance to be controlled is PRD. Under
Transport Routes, click on the QAS instance and click Create.
5. On the Create Transport Route screen, make sure Delivery is "on" and fill in
Source and Delivery systems with QAS and PRD. Click the green check mark to
save. Now you have met condition a. 6. Back on the Change Transport Routes screen, click on the QAS instance and
click the single pencil Change button. You will see a Change System
This document is the intellectual property of Jo Spencer and may not be edited without permission.
Attributes popup. Click "on" Quality Assurance - Delvery After Confirmation.
If you want to change the people who OK the transports, click the
Procedure button and make your changes. Then back out. Click the green check
to Transfer your changes.
7. Back on the Change Transport Routes screen, click on the Target Groups line
and click the Create button.
8. In the Create Transport Group popup, fill in the Target Group as /XXXCLNTS/,
give a Short Description and click the Client Assignment button. Be aware
that the Target Group name must start and end with a “/”. Enter each Target
system and Target client you need. Click the green check mark to Transfer.
You now have a target group. Now you must create a Consolidation Layer.
9. Back on the Change Transport Routes screen, click on Transport Routes and
click Create.
10. In the Create Transport Route popup, click the Extended Transport Control
button at the bottom of the popup. Make sure Consolidation is "on" and fill
in the information using our Target Group as the Consolidation Target. Click
the green check button to Save the change.
11. You now have a Transport Group. Confirm the Disturbution of it to the other
SAP Instances.
12. You may now leave the STMS transactions.
Return to Index...
Automate the Transport Process
1. Log on to client 000 of your TMS Domain Controller SAP Instance.
2. Go to transaction STMS.
3. On the Transport System Management screen, click Overview -> Imports.
Double-click on the queue for the SAP instance are in.
4. On the Import Queue screen, click the Refresh button. Click on the Import
All Requests button.
5. On the Start Import popup, fill in the information for the job. Make sure "At
Start Time" is on. Although Period appears grayed out, you can still change
it to the periodic value you need. I recommend every hour in DEV, 4 times a
day in QAS, and once an evening in PRD. Click on the green check mark to
Continue.
6. You may now leave tSTMS transaction. If you ever need to change this job,
he you must do it via STMS and not SE37.

SAP BASIS DB Interview Questions

Creating Database Statistics, Index Rebuilds, and Log Backup Jobs – MS SQL Server
Database statistics refresh jobs should be scheduled to run twice daily on all the SAP systems. But occasionally a manual refresh needs to be done due to table reorganization, index rebuild, etc.
1. Log on to the server using the adm user ID.
2. Open the MS SQL Server Enterprise Manager.
3. Expand the navigator tree until you see the Management entry. Expand it.
4. Right-click on Database Maintenance Plans and click New Maintenance Plan.
5. Use the wizard to create the job you need.
6. You may now close the Enterprise Manager session and log off the server.
Creating Database Statistics, Index Rebuilds, and Log Backup Jobs – Oracle
1. Log on to the appropriate SAP instance any client.
2. Go to transaction DB13.
3. On the DBA Planning Calender for Oracle Database : Maintain screen, double-click on a blank line on any day in the future.
4. On the Schedule Action for . DD.MM.YYYY popup, use the radio button to turn “on” the task you want to do. For each action, you need to fill in the Start Time in military time format, the Period (Weeks) which is how many weeks between running of this job – blank for one time only, 1 for weekly, 2 for bi-weekly, etc. and Calender if you want to use any calendar except the SAP supplied standard Factory calendar.
These are the details for each action:
Whole database offline + redo log or
Whole database offline backup or
Whole database online + redo log or
Whole database online backup
Generic tape names for database backup
Database backup profile – usually init.sap
Options for ReDo log backup
Redo log backup
Generic tape names for database backup
Options for ReDo log backup
Partial database offline backup or
Partial database online backup
Tablespace names to be included in the back up
This document is the intellectual property of Jo Spencer and may not be edited without permission.
Generic tape names for database backup
Database backup profile – usually init.sap
Check and update optimizer status
Tablespace names to be included in the statistics run
Adapt next extents
Tablespace names for next extents adaption
Check database
N/A
Verify database
Tablespace names to be verified
Database backup profile – usually init.sap
Cleanup logs
N/A
5. You may now leave the DB13 transaction.

SAP BASIS Printer Interview Questions

Creating, Modifying, Deleting, Transporting, and Resetting Print Devices
Creating a Print Device
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SPAD.
3. On the Spool Administration: Initial Screen screen, under the Devices/servers tab click the Output devices button.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
4. On the Spool Administration: List of Output Devices screen, click the pencil picture-icon to switch into change mode. The easiest way to create a new printer is to copy an existing one. Click on a similar printer in the output devices screen then click the create with template picture-icon.
5. On the Spool Administration: Create Output Device screen, fill in the Output device and Short name. Make any changes that are unique for the new printer on the Device Attributes and Host Spool Acc Method tabs. When all the required data has been changed/added, click the Save picture-icon.
6. You will receive an Output device was saved message in the status bar at the bottom of the screen. Click the lit match picture-icon to activate the printer.
7. You may now leave the SPAD transaction.
Return to Index...
Modifying a Print Device
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SPAD.
3. On the Spool Administration: Initial Screen screen, under the Devices/servers tab click the Output devices button.
4. On the Spool Administration: List of Output Devices screen, click the pencil picture-icon to switch into change mode. Double click on the output device to be changed.
5. On the Spool Administration: Output Device (Change) screen, make any necessary changes on the Device Attributes and Host Spool Acc Method tabs. When all the required data has been changed/added, click the Save picture-icon.
6. You will receive an Output device was saved message in the status bar at the bottom of the screen. Click the lit match picture-icon to activate the printer.
7. You may now leave the SPAD transaction.
Return to Index...
Deleting a Print Device
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SPAD.
3. On the Spool Administration: Initial Screen screen, under the Devices/servers tab click the Output devices button.
4. On the Spool Administration: List of Output Devices screen, click the pencil picture-icon to switch into change mode. Click on the output device to be deleted and then click the trash can picture-icon.
5. On the Spool admin.: Delete screen, verify that the correct printer is about to be deleted. Click the Yes button.
6. You will receive an Output device deleted message in the status bar at the bottom of the screen. You may now leave the SPAD transaction.
Return to Index...
Transporting a Printer or a Group of Printers
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SPAD.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
3. On the Spool Administration: Initial Screen screen, under the Devices/servers tab click the Output devices button.
4. On the Spool Administration: List of Output Devices screen, click the pencil picture-icon to switch into change mode.
5. Click on an output device to be transported and then click the truck picture-icon.
6. On the Spool Administration: List of Output Devices (Change) popup, click the green √ picture-icon.
7. On the Prompt for Workbench request popup, click the blank page picture-icon to create a new change request. On the Create Request popup, fill in the Short description and click the Save picture-icon. You will be returned to the Prompt for transportable Workbench request popup which contains the generated change request number for this system change. Click the green √ to continue.
8. You will receive an Entry is made in transport request message in the status bar at the bottom of the screen. Repeat steps 11 through 14 as many times as necessary, using the same transport request for all printers.
9. You may now leave the SPAD transaction.
Return to Index...
Resetting the Cache for a Printer
If resetting the printer cache does not clear your printing problem, try using
some a non-SAP application to print to it to see if it working correctly on the
network. This should at least narrow down the possibilities.
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SPAD.
3. On the Spool Administration: Initial Screen screen, under the Devices/servers tab click the Output devices button.
4. On the Spool Administration: List of Output Devices screen, double click on the printer you need to reset.
5. On the Spool Administration: Output Device (Display) screen, click on the pencil picture-icon to switch from display mode to change mode.
6. On the Administration: Output Device (Change) screen, on the top-most menu bar click Edit → Reactivate.
7. On the same Administration: Output Device (Display) screen, on the top-most menu bar click Edit → Reset Cache.
8. On the same Administration: Output Device (Display) screen, on the top-most menu bar click Edit → NI Reset.
9. You may now leave the SPAD transaction.
Return to Index...
Printer Output
Creating a Local aka Frontend Printer aka Desktop Printer
Local or frontend printing is sometimes confusing in concept but actually very easy to understand. As a rule, local printer is simply another way of saying that the user is going to print to the default printer designated on his/her workstation. You probably do this all the time with Windows to printer spreadsheets, Word documents, etc without thinking about it. You can do the same thing using SAP. 1. Log on to any client in the appropriate SAP system.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
2. Go to transaction SPAD.
3. On the Spool Administration: Initial Screen screen, click the Output Devices
button.
4. On the Spool Administration: List of Output Devices screen, click the
Change button and then the Create button.
5. On the Spool Administration: Create Output Device screen, fill in the
Output Name and Short name - I normally use a short name of “DESK” for
“Desktop Printing” but alot of people use a Short name “SWIN” or “LOCL”
as well. Use the following DeviceAttributes fields: Device type = SWIN Device Class = standard printer
And the following Access Method fields:
Host spool access method = F: Printing on frontend computer Host printer = __DEFAULT. That is _ _ D E F A U L T
Save the printer.
6. You may now leave the SPAD transaction.
Using this printer will cause print to go to SAPLPD which will use the default printer of the current workstation.
Return to Index...
Viewing a List of Pending Printer Output Requests for All Printers
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SP01.
3. On the Output Controller: Spool request selection Screen screen, click on the Output requests tab.
4. On the Output Controller: Output request selection Screen screen, fill in any information needed to filter the selection results. Then click on the clock picture-icon.
5. A list of all pending output requests will be displayed.
6. You may now leave the SP01 transaction.
Return to Index...
Viewing a List of Output Requests for a Specific Printer
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SPAD.
3. On the Spool Administration: Initial Screen screen, under the Devices/servers tab click the Output devices button. On the Spool Administration: List of Output Devices screen, click on the printer where you need to check the output requests. Then click on the printer and page picture-icon.
4. A list of all pending output requests for the selected printer will be displayed.
5. You may now leave the SPAD transaction.
Return to Index...
Reprinting a Document
This document is the intellectual property of Jo Spencer and may not be edited without permission.
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SP01.
3. On the Output Controller: Spool request selection Screen screen, fill in any information needed to filter the selection results. Then click on the clock picture-icon.
4. A list of all spool requests will be displayed. Double click on the spool request that is to be reprinted.
5. Click on the printer picture-icon. An Output request created message should appear in the bottom status bar.
6. You may now leave the SP01 transaction.
Return to Index...
Re-routing Print to a Different Printer
1. Log on to any client in the appropriate SAP system.
2. Go to transaction SP01.
3. On the Output Controller: Spool request selection Screen screen, fill in any information needed to filter the selection results. Then click on the clock picture-icon.
4. A list of all spool requests will be displayed. Double click on the spool request that is to be reprinted.
5. Click on the printer with a box outline picture-icon. On the Output controller: Print spool request XXXX screen, tab down to the line reading Output device and select a new printer. Click on the printer picture-icon.
6. On the Output control: Save attributes popup, click the Yes button.
7. On the Confirm redirection of output popup, click the Yes button. An Output request created message should appear in the bottom status bar.
8. You may now leave the SP01 transaction.

SAP BASIS Security Interview Questions

Creating a User Role
The easiest way to create a new user role is to copy an already existing user role, either one of your own or one of the ones provided to you in the installation of SAP. So let’s assume that you have none of your own and use one
This document is the intellectual property of Jo Spencer and may not be edited without permission.
of the SAP role templates provided. It might assist you with picking one of these roles if you have someone dump the appropriate information into a spreadsheet containing the Role Name, Role Description, Transactions contained in the Role, and the Transaction description. The SQL query would be something like this:
SELECT AGR_TEXTS.AGR_NAME, AGR_TEXTS.TEXT, AGR_TCODES.TCODE, TSTCT.TTEXT FROM AGR_TEXTS, AGR_TCODES, TSTCT WHERE AGR_TEXTS.MANDT = '000' AND AGR_TEXTS.SPRAS = 'E' AND AGR_TEXTS.LINE = 0 AND AGR_TCODES.MANDT = '000' AND AGR_TCODES.AGR_NAME = AGR_TEXTS.AGR_NAME AND TSTCT.SPRSL = 'E' AND TSTCT.TCODE = AGR_TCODES.TCODE ORDER BY AGR_TEXTS.AGR_NAME, AGR_TCODES.TCODE;
This query should be changed based on the details of your SAP instance. Identify the roles(s) to be used as the source for your role copy.
1. Log on to client needing the role.
2. Go to transaction PFCG.
3. On the Role Maintenance screen, either type in the role name to be copied or select it from a dropdown. Press Enter to confirm that the role exists.
4. Click the Copy role button or press Shift+F11.
5. One the Query popup box, fill in the to role field with the name to be given the new role. Come up with a standard that everyone follows so the base original role is designated in some way so you don’t forget where you got the original. The name must begin with Z or Y. Most people will add a Z- in the first two characters of the role name. If you want to only select specific roles from a Composite role, you would click the Copy selectively button, otherwise click the Copy all button.
6. Once the role has been copied, you will be taken back to the original PFCG screen where you will see the name of your new role. Change you Role description and save the new role before working with it any further
Return to Index...
Modifying a User Role
1. Log on to client needing the role change.
2. Go to transaction PFCG.
3. On the Role Maintenance screen, either type in the role name to be changed or select it from a dropdown. Press Enter to confirm that the role is found.
4. Click the Change Role little yellow pencil button role button or press F6.
5. Click the Authorizations tab and then the Change Authorization Data button.
6. On the Change Role: Authorizations screen, expand and change the authorizations you need to adjust. When finished click first the Save button and then the Generate button – looks like a little red and white beachball.
7. Back out to the Change Roles screen and click the User tab. Click on User Comparison and then Complete Comparison. Once the comparision is done, click Save one more time and you are done!
Return to Index...
Deleting a User Role
This document is the intellectual property of Jo Spencer and may not be edited without permission.
1. Log on to client needing the role deletion.
2. Go to transaction PFCG.
3. On the Role Maintenance screen, either type in the role name to be changed or select it from a dropdown. Press Enter to confirm that the role is found.
4. Click the Role Delete button or Shift+F2.
5. On the Delete Role popup, confirm that you wish to delete the deletion. If you get an Information popup, confirm it also.
6. Your deletion will return a successful message in the bottom status bar.
Return to Index...
Transporting User Roles between Clients (Transport System Method)
When a modification is made to a role in the 100 client, the roles must be transported to the 800 client. One role, several roles, or all roles can be done if needed. They can all be added to the same transport change request. After the roles have been moved to other clients, you will need to log on to each of those clients and do a user comparison. You will also need to do a text comparison in client 100 of the appropriate SAP system.
1. Log on to client 100 of the appropriate SAP system.
2. Go to transaction PFCG.
3. On the Role maintenance screen, type in the Role name of the first role to be transported. Click the Truck picture-icon.
4. You will see an Information popup. Click the green √ picture-icon.
5. In the Choose objects popup, unclick the □s beside User assignment and Personalization. If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment. Click the green √ picture-icon.
6. On the Prompt for Customizing request popup, click the blank page picture-icon to create a new change request. On the Create Request popup, fill in the Short description and click the Save picture-icon. You will be returned to the Prompt for Customizing request popup which contains the generated change request number for this system change. Click the green √ to continue.
7. You will see a Data entered in change request message in the status bar at the bottom of the screen. Now enter the name of the next role to be transported and click the Truck picture-icon.
8. You will see an Information popup. Click the green √ picture-icon.
9. In the Choose objects popup, unclick the □s beside User assignment and Personalization. If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment. Click the green √ picture-icon.
10. On the Prompt for Customizing request popup, continue to use the same transport you created in step 6. Click the green √ to continue.
11. Continue to perform steps 7 through 10 until all the roles you need to transport have been attached to the transport change request.
12. The generated transport can now be released and transported into the clients needing the modified roles.
13. You may now leave the PFCG transaction.
Return to Index...
Transporting User Roles between Clients (Upload/Download Method)
Central User Administration distributes clients and their information to the other clients connected to the Distribution Model. It does not, however, do the
This document is the intellectual property of Jo Spencer and may not be edited without permission.
same for roles and role authorizations. So when a modification is made to a role in the 100 client, the roles must be transported to the 800 client. One role, several roles, or all roles can be done if needed. They can all be added to the same transport change request. After the roles have been moved to other clients, you will need to log on to each of those clients and do a user comparison. You will also need to do a text comparison in client 100 of the appropriate SAP system.
1. Log on to client 100 of the appropriate SAP system.
2. Go to transaction PFCG.
3. On the Role maintenance screen, type in the Role name of the first role to be transported. Click the Truck picture-icon.
4. You will see an Information popup. Click the green √ picture-icon.
5. In the Choose objects popup, unclick the □s beside User assignment and Personalization. If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment. Click the green √ picture-icon.
6. On the Prompt for Customizing request popup, click the blank page picture-icon to create a new change request. On the Create Request popup, fill in the Short description and click the Save picture-icon. You will be returned to the Prompt for Customizing request popup which contains the generated change request number for this system change. Click the green √ to continue.
7. You will see a Data entered in change request message in the status bar at the bottom of the screen. Now enter the name of the next role to be transported and click the Truck picture-icon.
8. You will see an Information popup. Click the green √ picture-icon.
9. In the Choose objects popup, unclick the □s beside User assignment and Personalization. If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment. Click the green √ picture-icon.
10. On the Prompt for Customizing request popup, continue to use the same transport you created in step 6. Click the green √ to continue.
11. Continue to perform steps 7 through 10 until all the roles you need to transport have been attached to the transport change request.
12. The generated transport can now be released and transported into the clients needing the modified roles.
13. You may now leave the PFCG transaction.
Return to Index...
Performing a User Comparison on the Modified Roles
1. Log on to client 100 of the appropriate SAP system.
2. Go to transaction PFCG.
3. On the Role maintenance screen, type in the Role name of the first role to be transported. Click the Change button.
4. On the Change Roles screen, click the User tab.
5. On the User tab, click the User compare button.
6. On the Compare Role User Master Record popup, click the Complete compare button.
7. You will receive a User master record for role was adjusted message in the status bar at the bottom of the screen. You may now leave the PFCG transaction.
Return to Index...
Performing a Text Comparison to Refresh Role Selection Lists
This document is the intellectual property of Jo Spencer and may not be edited without permission.
1. Log on to client 100 of the appropriate SAP system.
2. Go to transaction SU01.
3. On the User Maintenance: Initial Screen screen, type in the user “model_user”. Click the pencil picture-icon.
4. On the Maintain User screen, click the Text comparison from child Syst. button.
5. On the CUA: Text comparison from Child Systems screen, type “LSDEV100” for the Receiving system and “LSQAS800” for the to system. This is a range, and since LSPRD300 falls alphabetically between LSDEV100 and LSQAS800, all three systems will have the text comparison performed. Click the clock picture-icon.
6. On the CUA: Text comparison from Child Systems results screen, you will see a list of the systems compared and the compare results. Click the white arrow on green picture-icon 3 times, or until you have left the SU01 transaction.
Return to Index...
Users, Roles, and Authorizations
SAP security is based on authorization objects and authorizations. An authorization object is used to indicate that a user can perform a certain activity. An authorization is used to limit the scope of that activity.
For example, a profile contains the S_DEVELOP authorization object. This authorization object allows a user to perform ABAP workbench activities. Some users will need to do all ABAP activites while others will only need to perform a few. So S_DEVELOP has a selection of authorizations you can use: ACTVT, DEVCLASS, OBJNAME, OBJTYPE, and P_GROUP. The authorizations are set to the appropriate values as needed. A tree view of the S_DEVELOP authorization object can be seen below:
S_DEVELOP
ACTVT
Create or generate
Change
Display
Delete
Activate, generate
Execute
Create in DB
Delete in DB
Convert to DB
Administer
Copy
All Functions
Deactivate Mod. assistant
DEVCLASS
Single Value or Value Range
OBJNAME
Single Value or Value Range
OBJTYPE
Single Value or Value Range
P_GROUP
Single Value or Value Range
The S_DEVELOP authorization object in a profile lets a user perform ABAP workbench activities. But having a S_DEVELOP authorization object with the ACTVT
This document is the intellectual property of Jo Spencer and may not be edited without permission.
authorization value set to Display (03) means that the user is limited to display only in the ABAP workbench transactions. Thus we see that authorization objects grant while authorizations limit. It is important to remember, however, that a user with a profile having a S_DEVELOP with full authorizations still cannot access an ABAP workbench transaction until a matching S_TCODE (start up transaction code) has been added as well. In other words, a user may have the rights to add, modify and delete ABAP programs but until an entry for SE38 has been added to the S_TCODE authorization object, he cannot access transaction SE38 which is the ABAP Editor.
All authorization objects and authorizations are grouped into profiles before being attached to users. Profiles use a combination of authorization objects and their respective authorizations, and their creation can be complex as well as tedious. In order to simplify the creation of profiles, the Profile Generator (transaction PFCG) was created. Roles are created via a more user-friendly interface which generates profiles based on the information added via this interface.
Manually creating profiles is the “old” way of doing things. There are times, such as the start of a new SAP landscape where no roles exist, that the use of profiles is handy. But once the landscape has been completed all users, with the exception of the Basis team, should be attached to roles. There should never be a need to manually create a SAP new profile. To add a new role, the easiest method is to copy an existing role that matches your needs as closely as possible and make the changes you need for the new role.
This documentation covers changing user security via both methods.
Adding Authorization Objects and/or Authorizations to a Profile
Remember that profiles are NOT the standard way to implement SAP security
1. Log on to the appropriate client in the appropriate SAP system.
2. Go to transaction SU02.
3. In the Manually edit authorization profiles section of the Profile: Initial Screen screen, enter the Profile you want to change. Make sure the Active only □ is checked. Click the Create work area for profiles button.
4. On the Profile List screen, double-click the profile to be changed.
5. A profile can contain authorization objects only (single profile) or one or more other profiles (collective profile). If the next screen is titled Maintain Profile, this is a single profile, and you should proceed to the next step. If the next screen is titled Collect Profiles, this is a collective profile and you should skip to step 13.
6. On the Maintain Profile screen, you must decide if you need to add a new authorization object and one or more of its authorizations, or add a new authorization to an authorization object already in the profile. If you need to add a new authorization to an authorization object already in the profile, skip to step 7. Otherwise, scroll down the Consisting of authorizations list until you find a blank line. Type the authorization object you need to add and press Enter. You will need to scroll through the list again until you find the authorization object you just added (it is was to find since the Authorization column should still be blank). Once you find the new entry line, use the drop down to fill in the Authorization column. Click on the Save picture-icon.
7. If you need to add another authorization to an authorization object already in the profile list, click on the +Add authorization button.
8. From the Maintain Profiles: Object Classes screen, double-click the Object class of the authorization you are adding.
9. On the Maintain Profiles: List of Authorizations screen, select the authorization you need to add by double-clicking the appropriate line. This
This document is the intellectual property of Jo Spencer and may not be edited without permission.
will return you to the Maintain Profile screen where you can see that your authorization has been added.
10. On the Maintain Profile screen, click the Save picture-icon. Then click the lit match picture-icon to activate the new profile changes.
11. On the Activate Profile: Execution Screen screen, click on the lit match picture-icon to complete the profile activation process.
12. You may now leave the SU02 transaction.
13. In order the change a profile collection, you must make the changes in one or more of the dependent profiles, save the changes in the dependent profile(s), activate the dependent profile(s), save the collection owner profile, and activate the collection owner profile. On the Collect Profiles screen, double-click on the profile you want to change.
14. You will be taken to the Maintain Profile screen. Perform steps 6 to 11. Then use the white arrow on green picture-icon to go back.
15. On the Collect Profiles screen, click the Save picture-icon. Then click the lit match picture-icon to activate the new profile changes.
16. On the Activate Profile: Execution Screen screen, click on the lit match picture-icon to complete the profile activation process.
17. You may now leave the SU02 transaction.
Return to Index...
Adding Authorization Objects and/or Authorizations to a Role
1. Log on to client 100 in the DEV SAP system.
2. Go to transaction PFCG.
3. On the Role Maintenance screen, enter the Role you want to change. Click the Change button.
4. On the Change Role screen, click the Authorizations tab and then click the pencil picture-icon.
5. If you are only adding a start up transaction to the role, skip to step 10. Otherwise, the assumption is that a new authorization object is to be added. On the Change role: Authorizations screen, click the +Manually button.
6. On the Manual selection of authorizations popup, enter the authorizations objects that need to be added (ie S_DEVELOP, S_PROGRAM, etc.) Click the green √ when you are finished.
7. Back on the Change role: Authorizations screen, if all the displayed signal lights are green, skip to step 8. Otherwise, fully expand the lines that are yellow and/or red and supply the necessary information. All signal lights should be green before moving to the next step.
8. On the Change role: Authorizations screen, click the Save picture-icon. You will receive a Data saved confirmation message in the status bar at the bottom of the screen.
9. On the Change role: Authorizations screen, click the red-and-white beach ball picture-icon to generate a profile from the saved role. Reply affirmatively if any confirmation popups. You will receive a Profile(s) created message in the status bar at the bottom of the screen. If you do not need to add any start up transactions to the profile, you may now leave the PFCG transaction.
10. On the Change Role: Authorizations screen, expand the Cross-application Authorization Objects → Authorization Check for Transaction Start → Authorization Check for Transaction Start until you see the Transaction code entry line. Double-click on the entry portion of the Transaction code line.
11. In the Maintain Field Values popup, scroll down the list until you find a blank From and To line. Enter the transaction(s) to be added, and click the Save picture-icon when you have finished.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
12. On the Change role: Authorizations screen, click the Save picture-icon. You will receive a Data saved confirmation message in the status bar at the bottom of the screen.
13. On the Change role: Authorizations screen, click the red-and-white beach ball picture-icon to generate a profile from the saved role. Reply affirmatively if any confirmation popups. You will receive a Profile(s) created message in the status bar at the bottom of the screen.
14. You may now leave the PFCG transaction.
Return to Index...
Granting Transaction Access to a User via Profile
*** Since SAP R/3 4.5, this is not the standard for user authorizations.
***
Return to Index...
Granting Transaction Access to a User via Role
1. Log on to the applicable SAP instance and client.
2. Go to transaction SU01.
3. On the User Maintenance: Initial Screen screen, fill in the User ID for the user you want to change, either by typing it in or choosing it from the drop down. Click the little yellow pencil Change button.
4. On the Maintain User screen, click on the Roles tab. Fill in the new role in the first available Role field. Press ENTER to confirm that the role exists. Click the Save button.
5. Make sure to use transaction PFCG to run a user comparion to rebuilt the role-to-user connections.
6. You may now leave the PFCG transaction.
Return to Index...
Revoking Authorizations from a User via Profile
*** Since SAP R/3 4.5, this is not the standard for user authorizations.
***
Return to Index...
Revoking Authorizations from a User via Role
Use the same procedure as Adding Authorization Objects and/or Authorizations to a
Role
Return to Index...
Revoking Transaction Access from a User via Profile
*** Remember that profiles are NOT the standard way to implement SAP security. ***
Return to Index...
This document is the intellectual property of Jo Spencer and may not be edited without permission.
Attaching a Profile to a User
*** Since SAP R/3 4.5, this is not the standard for user authorizations.
***
Return to Index...
Attaching a Role to a User
1. Log on to the applicable SAP instance and client.
2. Go to transaction SU01.
3. On the User Maintenance: Initial Screen screen, fill in the User ID for the user you want to change, either by typing it in or choosing it from the drop down. Click the little yellow pencil Change button.
4. On the Maintain User screen, click on the Roles tab. Fill in the new role in the first available Role field. Press ENTER to confirm that the role exists. Click the Save button.
5. Make sure to use transaction PFCG to run a user comparion to rebuilt the role-to-user connections.
6. You may now leave the PFCG transaction.

SAP BASIS Support Package Interview Questions

In order to apply new support packages and kernel patches to a SAP system, several preparation steps are required:
• Checking for new SPAM updates, support packages and kernel patches
• Downloading the new SPAM updates, support packages, and kernel patches
• Preparing the new SPAM updates, support packages, and kernel patches for application
• Applying the new SPAM updates, support packages, and kernel patches
• Mass recompiling all programs used in patched components
Be aware that SPAM/SAINT update and support package application occurs within the SAP system using the SPAM transaction. These corrections are changes to ABAP program code and must be handled in a special way by SAP. Kernel patches, on the other hand, are fixes to SAP executables found on the SAP server. Kernel patches must be applied when the SAP instance is down.
Please refer to the Check for New SPAM Updates, Support Packages and Kernel
Patches.
Return to Index...
Checking for New SPAM Updates, Support Packages and Kernel Patches
To check if SAP has released any new software fixes for your release of SAP, you need to know your current support package and kernel release levels.
The patching process consists of:
- finding you current patch levels
- finding what patches you should be applying
- downloading the patches
- unCARing the patches
- loading the patches into the patching EPS queue
- applying the patches
Return to Index...
Find your Current SPAM Update and Support Package Level
Method One:
1. Log on to your SAP instance, any client.
2. On any SAP screen, click System -> Status…
3. On the System: Status popup, click the Component Information button.
4. On the System: Component Information popup, you will see the support package
level for each component installed in your current SAP instance.
Method Two:
1. Log on your SAP instance, any client.
2. Go to transaction SPAM.
3. On the Support Package Manager screen, turn “on” the radion button beside
the Imported Support Packages in the Directory section of the screen, and
then click Display button.
4. On the OCS Package Directory: Imported Packages screen, you will see a list
of all SAP Support Packages imported into your current SAP instance.
Return to Index...
Find your Current Kernel Patch Level
Method One:
1. Log on to your SAP instance, any client.
2. Go to transaction SM51.
3. On the SAP Servers screen, click on the server for which you need the information and then click on the Release Notes button.
4. On the SAP Release Information from Server screen, look down the SAP R/3
Kernel information section until you find Kernel Patch number. To the right,
you will find the current patch level of your current SAP instance.
Method Two:
1. Log on to the SAP instance sever using a Telnet session as user adm.
2. Change the Telnet windows properties to use a Screen Buffer Size of 9999.
3. At the Linux prompt, type:
disp+work –v
and press ENTER.
4. Scroll back up the listing to where you entered the command in step c.
5. Scroll down the listing untill you find a line beginning patch number. To
the right is the patch number for the SAP instance hosted on this server.
Return to Index...
Find the Most Current SAP Support Packages
It should be noted here that sometimes an older SAP may run on a newer SAP Basis level. For example, CRM 4.0 has a Basis level of a 6.20 instance but runs on a 6.40 kernel. So make sure that the kernel patches you download match the SAP R/3 Kernel located via SM51.
1. Log on to the SAP Marketplace using an OSS ID with Administration rights – http://service.sap.com/patches.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
2. In the navigator tree on the right-hand side of the My Application Components screen. For example, to find new patches for CRM Basis expand as follows:
Support Packages and Patches
My Company’s Application Components
SAP CRM
SAP CRM 4.0
Entry by Component
CRM Server
SAP BASIS 6.20
3. Scroll down the Download screen until you find your current package level. Any support packages after your current level will need to be applied to your SAP System.
4. You may now leave the SAP Marketplace.
Return to Index...
Find the Most Current SAP SPAM Update
1. Log on to the SAP Marketplace using an OSS ID with Administration rights – http://service.sap.com/patches.
2. In the navigator tree on the right-hand side of the My Application Components screen. For example, to find new patches for SPAM/SAINT for CRM 6.20 expand as follows:
Support Packages and Patches
My Company’s Application Components
SAP SPAM/SAINT UPDATE
SPAM/SAINT UPDATE 6.20
SPAM/SAINT UPDATE 6.20
3. Click the Download tab of the SPAM/SAINT UPDATE screen. Find the SPAM/SAINT Update – Version XXX value. If this SPAM version is higher than you current SPAM version, you will need to download and apply the latest SPAM update.
4. You may leave the SAP Marketplace.
Return to Index...
Find the Most Current SAP Kernel Patches
1. Log on to the SAP Marketplace using an OSS ID with Administration rights – http://service.sap.com/patches.
2. In the navigator tree on the right-hand side of the My Application Components screen. For example, to find new patches for CRM 4.0 expand as follows:
Support Packages and Patches
My Company’s Application Components
SAP KERNEL 32-BIT
SAP KERNEL 6.40 32-BIT
Linux on IA32 32bit
ORACLE & #Database independent
3. Scroll down the Download screen until under the File Name column you find SAPEXEDB*.SAR files. Unless SAP has instructer you to use a different
This document is the intellectual property of Jo Spencer and may not be edited without permission.
kernel, the most recent SAPEXEDB*.SAR is the one you need to download. You may leave the SAP Marketplace.
4. Now go to the @Database independent section in the same list as ORACLE was displayed. Scroll down the page until you find the SAPEXE*.SAR that matches the same number as the SAPEXEDB*.SAR you found in the previous step. These two files will give you a complete kernel replace.
5. You may leave the SAP Marketplace.
Return to Index...
Download SPAM/SAINT Updates
1. Log on to the SAP Marketplace using an OSS ID with Administration rights – http://service.sap.com/patches.
2. In the navigator tree on the right-hand side of the My Application Components screen. For example, to find new patches for SPAM/SAINT for CRM 6.20 expand as follows:
Support Packages and Patches
My Company’s Application Components
SAP SPAM/SAINT UPDATE
SPAM/SAINT UPDATE 6.20
SPAM/SAINT UPDATE 6.20
3. To download a SPAM/SAINT update, click on the SPAM/SAINT Update Title hyperlink. Click the Download button. On the File Download popup, click the Save button. On the Save As popup, select a location to store the SPAM/SAINT update and click the Save button. Alternatively, you may add the patch to your SAP Download Manager and download all patches in one batch group.
4. Once you have downloaded your SPAM/SAINT updates, you may leave the SAP Marketplace.
Return to Index...
Download SAP Support Packages
1. Log on to the SAP Marketplace using an OSS ID with Administration rights – http://service.sap.com/patches.
2. In the navigator tree on the right-hand side of the My Application Components screen. For example, to find new patches for CRM Basis expand as follows:
Support Packages and Patches
My Company’s Application Components
SAP CRM
SAP CRM 4.0
Entry by Component
CRM Server
SAP BASIS 6.20
3. To download a support package, click on the package Title hyperlink. Click the Download button. On the File Download popup, click the Save button. On the Save As popup, select a location to store the support package and click the Save button. Alternatively, you may add the patch to your SAP Download Manager and download all patches in one batch group.
4. Once you have downloaded as many support packages as you need to apply, you may leave the SAP Marketplace.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
Return to Index...
Download SAP Kernel Patches
1. Log on to the SAP Marketplace using an OSS ID with Administration rights – http://service.sap.com/patches.
2. In the navigator tree on the right-hand side of the My Application Components screen. For example, to find new kernel patches for CRM 4.0 expand as follows:
Support Packages and Patches
My Company’s Application Components
SAP KERNEL 32-BIT
SAP KERNEL 6.40 32-BIT
Linux on IA32 32bit
ORACLE
3. To download a kernel patch, click on the SAPEXEDB_.SAR hyperlink. Click the Download button. On the File Download popup, click the Save button. On the Save As popup, select a location to store the kernel patch and click the Save button. Alternatively, you may add the patch to your SAP Download Manager and download all patches in one batch group.
4. Now backup a step and instead of clicking ORACLE, click #Database independent. The full path would look like this:
Support Packages and Patches
My Company’s Application Components
SAP KERNEL 32-BIT
SAP KERNEL 6.40 32-BIT
Linux on IA32 32bit
#Database independent
5. This produces a list of database independent kernel patches. Scroll down the Download screen until under the File Name column you find SAPEXE_.SAR. Use the same instructions in step 5 to download the patch. Make sure that the version number of your database independent files matches the version number of your MS SQL Server dependent file.
6. Once you have downloaded the kernel patch, you may leave the SAP Marketplace.
Return to Index...
Download Other SAP Binary Patches
Unlike SPAM/SAINT updates, support packages, and kernel patches, the storage location for other SAP binary patches can be either SAP Marketplace or sapserv1. SAP Marketplace is the normal respository but if you can’t find your patch there, go look on sapserv1.
***Due to the shutdown of the sapserv1x servers in April, this section has been discontinued. Everything should now to accessible via SAP Marketplace.***
R
eturn to Index...
Prepare a SPAM/SAINT Update or Support Package for Application
Once you have downloaded your SPAM/SAINT Update and/or support package(s), they must be moved to the appropriate transport directory and uncompressed.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
1. For a SAP instance, move the downloaded K*.?AR file to the /usr/sap/trans/tmp directory on the SAP Transport Domain Server which is normally the DEV server of a SAP “Flavor”.
2. Log on to the appropriate server as adm.
3. Type the following:
cd /usr/sap/trans ¬
SAPCAR.EXE -xvf “tmp\*.?AR” ¬
This will unCAR all CAR and SAR files in the \usr\sap\trans\tmp directory to the /usr/sap/trans/EPS/in.
4. Log off the server.
5. Log on client 000 of the appropriate SAP system.
6. Go to transaction SPAM.
7. From the menu bar of the Support Package Manager screen, click Support Package → Load Packages → From application server.
8. On the SPAM: Confirm upload popup, click the green √ picture-icon. The progress of the support package loads will show in the status bar at the bottom of the screen.
9. Scroll down the SPAM: Uploading Packages from the file system screen to make sure your SPAM/SAINT update is listed. Use the Go Back icon to return to the previous screen.
10. You may now leave the SPAM transaction.
Return to Index...
Prepare a Kernel Patch for Application
Kernel patches must be applied on the SAP server. The SAP instance must be down before a kernel patch can be applied.
1. Logon the server to be patched as adm.
2. The downloaded SAPEXE*.SAR and SAPEXEDB.SAR files must be uncompressed using SAPCAR.EXE. You can place the SAPEXE*.SAR files in any directory and use the SAPCAR.EXE –xvf “*.?AR” to unCAR the files.
3. You may now leave the server.
Return to Index...
Prepare other SAP Binary Patches for Application
Use the same procedure as Preparing a Kernel Patch for Application.
Return to Index...
Application of SPAM/SAINT Updates
Before you apply the most current SPAM/SAINT, please pull the OSS Note 484219 - Known problems with transaction SAINT in Basis Release 6.20 or for whatever version you are using and review any problems you may have adding the SPAM/SAINT patch.
Once you have loaded the latest SPAM/SAINT update into your support Package manager buffer, you need to apply the update to your SAP system.
1. Log on client 000 of the appropriate SAP system.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
2. Go to the SPAM transaction.
3. From the menu bar of the Support Package Manager screen, click Support Package → Import SPAM/SAINT update. Click the green √ picture-icon to continue.
4. The progress of the SPAM/SAINT update application will be displayed in the status bar at the bottom of the screen. These messages look very similar to the messages generated during a change request transport.
5. When the Restart SPAM popup appears, click the green √ picture-icon to leave the SPAM transaction.
6. Go to the SPAM transaction. You may notice programs compiling in the status bar at the bottom of the screen. This is normal.
7. Once you are again on the Support Package Manager screen, verify that the SPAM status in the Status section of the screen contains a green light.
8. You may now leave the SPAM transaction.
Return to Index...
Application of SAP Support Packages
Before applying any support packages to your SAP system, release all “repair” change requests to prevent error messages due to locked resources. Repairs are usually advanced corrections obtained from SAP Notes that are eventually accumulated into support packages. So the same objects “repaired” in the advanced corrections will be “repaired” during the application of the support package. Releasing the repair change requests allows the support package to overlay the temporary advanced correction “fix”.
Before you apply the most current SPAM/SAINT, please pull the OSS Note 782140 - OCS: Known problems with Support Packages in Basis Rel.6.20 or for whatever version you are using and review any problems you may have adding the SPAM/SAINT patch.
Once you have loaded the latest support packages into your support
Package manager buffer, you need to apply the packages to your SAP
system.
1. Log on client 000 of the appropriate SAP system using a adminitrator user ID that is not DDIC or SAP*.
2. Go to the SPAM transaction.
3. On the Support Package Manager screen, click the Display/Define button to build your import queue. On the Component Selection popup, click on the Comp. ID having support packages you want to install. The component order support packages should be applied is SAP_BASIS, SAP_ABA, SAP_APPL, and PI.
4. A list of all application support packages for the selected component will appear in the Define Queue popup. Select the support packages you want to apply. See SAP Note 782140 for information on restrictions to grouping support packages into queues. The Package ID with the green √ to the left is the highest support package to be placed in the queue. All lower number support packages for this component will be applied as well. Click the green √ picture-icon to confirm the queue.
5. From the menu bar of the Support Package Manager screen, click Support Package → Import queue.
6. On the SPAM: Import Queue popup, read the displayed information and then click the green √ picture-icon to continue.
7. The progress of the support package application will be displayed in the status bar at the bottom of the screen. These messages look very similar to the messages generated during a change request transport.
This document is the intellectual property of Jo Spencer and may not be edited without permission.
8. When the Imported successfully Information popup displays, click the green √ picture-icon to continue.
9. On the Support Package Manager screen, verify that the SPAM status in the Status section of the screen contains a yellow light and the Next action value is Confirm queue. To confirm that your support packages applied completely, click the green √ picture-icon. A Support Package queue was confirmed message will appear in the status bar at the bottom of the screen.
10. You are ready to build another support package queue, or if you have applied all the necessary support packages, you may now leave the SPAM transaction.
Return to Index...
Application of SAP Kernel Patches
*** It is recommended that the /usr/sap//SYS/exe/run directory be copied to /usr/sap//SYS/exe/backup_run before replacing the kernel ***
1. Log on to the appropriate server as adm.
2. Double check that the SAP instance, SAPOSCOL, and SAP_00 services are stopped.
3. To apply the new kernel patch to a R/3 instance, copy the new files into usr\sap\\SYS\exe\run directory. If prompted for overwrites, say yes to all.
4. After the new kernel has been copied make sure that the following file ownerships are correct:
All files in /usr/sap//SYS/exe/run adm
/usr/sap//SYS/exe/run/saposcol root
/usr/sap//SYS/exe/run/br* ora
/usr/sap//SYS/exe/run/sapdba ora
5. After the successful completion of the kernel patch, you may bring the instance back up and log off the server.
Return to Index...
Application of other SAP Binary Patches
Use the same procedure as Application of SAP Kernel Patches.