1. Go to SQL Server Management

2.Select the database ID for which you want to change the owner

3.Execute the query as below (Click on New Query)

exec sp_changedbowner ’sa’

It is using Windows authentication for SQL login.

The above query will change the database owner to ’sa’ all Sytem Administrators.

• what is sap kernel upgrade

The Database part consists of the ABAP Repository which consists of programs, tables, structures, domains, data elements etc., they reside inside the database software under the instance name <SID>. They may also be accessed partly through standard database tools. However, it is not recommended to make any modifications to the database directly because, direct modifications to database are not reflected in the ABAP data dictionary.

The Database Release and the R/3 kernel release may differ. Always the kernel release should be equal to or greater than the database release. SAP releases the various kernel and their downward compatibility in R/3 notes. These notes are frequently updated and hence it is required that though you might have obtained a hard copy long time back, it is still mandatory for you to access the same note again to understand if there are any changes. The downward compatibility matrix shows what is the lowest release of R/3 database that the kernel can work with.

Before you can upgrade to a higher kernel version, it must be checked whether your existing Operating System release and Database release are compatible. Otherwise, you will definitely need to upgrade them before upgrading the kernel. How to upgrade the kernel is also available as a note on the R/3 Online Support System. However, before upgrade of the kernel, the old kernel should be backup so that it can be used to revert back to old status in case of any problem.

_

_

_

• How to Find out current kernel version sap

1. Start transaction SM51. Position the cursor on the server from which you want the current kernel version and patch level, then choose function ‘Release notes’. You will get a list containing information about the current R/3 kernel as well as the supported environment and a listing of all the patch texts with their corresponding note numbers.

2. From the operating system level - change to the directory that contains the SAP executables, i.e., /sapmnt/<SAPSID>/exe, and execute ‘disp+work –V’.

support packages in sap

support pack upgrade sap

support packs in sap

• What is Support Packs in SAP:

Types of Support Packages are listed below:

HR Support Package

ABAP Support Package

APPL Support Package

Basis Support Package

Add-on Support Packages

These are available for download directly from the SAP Service marketplace at below link

SPAM package download: service.sap.com/patches

On demand the Support packs available are sent in form of CDs to SAP’s customers. The system should be update by the designated personnel as early as possible. The support packages have certain dependencies and the same is to be checked on. Basis and ABAP support packages can be loaded independently whereas special care is to be taken while loading application support packages to include the CRTs of addon packages otherwise some conflict can arise and system can go to an unstable state.

_

_

_

• How to apply Support Packs (SPAM package) to SAP :

After collecting the required information on CRTs and the like, the Support packs can either be downloaded from the SAPNET or uploaded from (Support packages) CD into the usr/sap/trans/EPS/in directory. The CAR files will also have to be extracted to the same directory.

Login to the system on client 000 - With any user-id other than SAP* or DDIC. The login-id should have SAP-ALL and SAP-NEW authorizations.

Run transaction code SPAM to invoke the SAP Patch manager. You can choose the upload button to upload data directly from /usr/sap/trans/EPS/in directory on the server or from a path on your local Front end.

Execute the “SPAM” transaction again. You will now be able to see the support packs window. Use the drop down box menu to verify the queue. The support packs will be in the queue followed by their corresponding CRT’s for the different add-on. Press the consistency check button to verify the queue is okay.

Go to the Menu Option settings on the SPAM screen and change the settings from ”S” to “T” (Standard to Test mode) The queue may be applied in test mode to check if it has conflict with any object that is already modified in the system. If there are any modifications to the program that the hot pack is also affecting, then the hot pack will create versions for the same. It will make the program delivered by it to be the current request the active version. Transaction “SPAU” (SAP Adjustments) will need to be run to make the required adjustments. If CIN programs are also affected, please check with SAP India.

_

_

_

Please Note:

Make sure that you have applied the latest SPAM update before you apply any other patches.

Always apply patches to your test system before you start to apply them to your production system!

Only the system administrator should be able to download, apply, confirm, or reset the status of patches. To use all the SPAM functions, you require the authorizations.S_CTS_TR_ALL and S_CTS_ADMIN. You can find both of them in the authorization profile S_A.SYSTEM

Ensure that you are logged into client 000 with the proper authorizations. If you log into another client, or do not have the correct authorizations, you can only use the display functions.

Make all the users log off before you apply patches in scenario ‘S’. During the patch application steps, the R/3 system must not be in use, i.e. only the system administrator is allowed to be logged on. Otherwise you risk program terminations.

Shut down all application servers except the central one for the duration of the import. Otherwise, buffer synchronization problems with program terminations, and possibly data inconsistency, may result.

You cannot have any incompletely applied patches in your system. To check this, under Directory choose Aborted patches and then choose Display. No patches should be displayed. Under the section Patch, the status should display a green traffic light.

Check the logs before confirming the patch application.

Never apply patches directly with tp. You will lose all of your modifications and overwrite your Add-On, if you have installed one. If you have made a modification adjustment for the Patch Queue in your test system, ensure that you do not import the resulting modification adjustment transport into further systems until you have applied the same patches to these systems.

While a patch is being applied the session is blocked. Open a second session before you apply the patch to avoid logging on again.

The Note would also mention at what support package level the error is corrected in. Sometimes it is not possible to apply all the support packages. Then the corrections have to be performed manually. It is a good idea to document and make the corrections in an orderly fashion. This will be of help at a later point of time during an upgrade or when further support packages are being applied, which may affect the same programs.

Whenever a line is being inserted or deleted, SAP recommends that the note number (that suggested the change) be typed on the same line. This will be very helpful later during the application of further corrections. It is also recommended that the ABAP modification assistant is activated to be able to track changes.

_

_

_

• Download SAP Note

1. what is SAP (System, Application and Products)?

• SAP is an ERP(Enterprise Resource Planner).

• SAP is a software for Big Enterprises as well as for Small and Medium EnterPrises.

• SAP contains all functional modules like

MM Material Management

PP Production Planning

HR Human Resources

FI Finance

CO Controlling

SD Salse and Distribution

etc

• SAP is Hardware, Database and OS independent.

It can be installed on any hardware and it can work with different databases like Orale, MS SQL, DB2.

SAP also provides Industry specific software like Banking, Aviation, Oil industry, Defense etc.

• Supporting modules for reporting and for presentation are also available from SAP.

Like

SAP BW/BI - SAP Business Intellegence

For Dynamic Reports

.

SAP EP - Enterprise Portal

For Company portal to display company news and give Single Sign on for every user.

.

SAP XI - eXchange Infrastructure

To merge Company’s old legacy Software with SAP ERP

Steps to install extra languages in to a SAP system.

1. Download Language DVD from SAP Service Market Place suitable to your SAP ECC version(e.g SAP 4.7, ECC 6.0 etc)

2.Place .PAT files to EPS/in folder.

3.Login to SAP in client 000 with Admin user.

4. Execute SE38

5. Execute program RSCPINST

6.Add an entry for the language you are willing to install.

7. Execute transaction SMLT

8. Create a new entry in SMLT for the required language. Give Supplementation language as English.

9.Click on the Import Language/Package symbol next to newly created entry for your language.

10.Default path is set to EPS/in folder, where it will search for the .PAT file required.

11.Found language should show either Green or Yellow button. If it is showing Red button it means you have downloaded the wrong source. Double check on SAP Service Market Place and download the right source files.

12. Press Execute to install the selected Language.

13.Monitor the import process in SM37 and Import transport logs.

14.Once installation get finished go to SE38, execute RSCPINST.

15. Click on Simulate button and copy new value for parameter zcsa/installed_languages.

16.Go back and activate the settings.

17. Go to RZ10 and change instance profile.Add new parameter  zcsa/installed_languages and set its value as suggested in point 15 above.

18.Restart the SAP instance and try login with new Language.

19. Go to SE38

 Execute RSTLAN_IMPORT_OCS

 Select the newly installed language and press OK

 It will show you the support packages whose language parts you want to import.

20.     GO to Next screen.

 Copy the PAR or CAR files to EPS/in folder for all support packages showing in RED. 
 
 This will import the language specific parts of those support packages.

 Press Import Language Data and Overwrite.

 It will show you the message “The Support Package Language Data was imported correctly.All system languages are up to date.

21. Next step is to copy the client specific data to required client.

 Login to yr non default client or product client.

 Go to SE38 and execute RSREFILL.

22. Refference Language EN
 
 Language to be updated Newly installed one
 
 Update Mode I
 
 Log Directory \sapmnt\trans\*.snd

23. Go to SE38
 
 Execute RSTLAN_SUPPLEMENT_UNI
 
 Select your language from drop down
 
 Press Client Maintenance with Customizing Translations

Find below steps to Reset the OCS queue while applying add on / support packs.

While applying add on or support packs, if process hang up in IMPORT_PROPER phase of DDIC activation phase etc and if you are not able to re import or reset the queue, please follow below procedure.

At command line on <sidadm> prompt

Run below command

tp r3i all <SID> pf=/usr/sap/trans/bin/TP_DOMAIN_<SID>.PFL tag=spam -Dclientcascade=yes -Drepeatonerror=8

After this it will again come on your <sidadm> prompt.

Then go in se37 run below program

ocs_reset_queue

Hit F8

Give following parameter

IV_TOOL = SPAM / SAINT

IV_FORCE = X

Hit execute.

Now run SPAM or SAINT and redefine your queue.

A SAP instance is all the components created by the SAPinst program who all share the same database.  There are three mandatory sub-instances;  the Database Instance (DB), the Central Instance (CI), and the Dialog Instance (DI) aka Application Server.  This is the minimum configuration of any SAP instance.  There can be multiple DIs but only one DB and only one Active CI which means that a copy of the CI can exist for High Availability but only one of the CIs can be active at any given time.  You will hear about SAP being multi-tiered and that term is referancing these three layers.  Sometimes you might see “other SAP tiers” like ITS but that really isn’t a separate tier, it used to be an additional piece of software working with IIS, and now ITS is part of Basis/WAS so it is part of the CI Tier. These layers, plus other SAP written software, are also known as the SAP Business Framework.

You can probably guess at what the DB contains.  There are any number of tables in a SAP instance, from 21,000 to 38,000.  Many have four or five character names that are usually abbreviations of things like USR for user, MANDT for client, etc.  You could guess that USR is short for user.  But MANDT?  So, we add one more variable to the equation – those four or five character names are abbreviations of German words.  Needless to say, trying to look at SAP from a typical DBA prospective is almost impossible.  Fortunately, SAP supplies the tools for you to manage all these tables.

The Central Instance is a lump term for all the SAP executables, the installed OS file structure, and anything that is placed on the OS to support and communicate with the SAP instance.  It “talks” to the database, handles requests made by the application server(s), and sends back the information.  Other software products often call this the middleware layer. 

The Dialog Instance connects the users to the CI, passes the issued requests to the CI, and sends the returned results to the user’s session.  SAP uses a client piece called SAPGui which handles the user-to-DI communication on the user’s workstation.

These are the three main pieces of a SAP instance installation.  There are other parts that can be added for various sub-access and external tasks.  For a Development SAP instance or a Quality & Assurance or Test SAP instance, all three layers are normally installed on the same server.  For a Production SAP instance, the DB/CI are often installed on one server and the DI on another server for load balancing purposes.  It should be noted that the installation of a CI instance automatically installs a DI which can be used by everyone if needed, be used only as needed by Basis staff, or never be used.

Instance can be a difficult term to understand – almost every major database applies this term to the installation of the database software.  So if you see reference to an Oracle instance, this means the installation of the Oracle software.  An Oracle database is the creation of a new empty database within that Oracle instance.

Understanding the Startup and Shutdown prodedures may help solidify this layer concept.

The normal SAP instance start up consists of three parts: starting the SAP OS Collector, starting the Oracle Listener, and starting the SAP instance. The process mainly goes like this:  ora<sid> logs on and starts the Oracle Listener then  <sid>adm logs on and runs the startsap script. ]]> http://www.folkszone.com/what-is-a-sap-instance/1644/feed http://www.folkszone.com/sap-basis-tutorials-unix-linux-page17/1500 http://www.folkszone.com/sap-basis-tutorials-unix-linux-page17/1500#comments Wed, 18 Mar 2009 02:32:48 +0000 admin http://www.folkszone.com/?p=1500 User Tasks

1.               Log on to the appropriate SAP system and the client where the new user is to be added.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the new User name and click the blank page picture-icon.

4.               On the Maintain User screen, fill in at least the following information for each tab:

Address           Last name, First name, Internet mail

Logon data        Initial password, repeat password, user type

Defaults          Decimal formation, Date formation, Time zone, OutputDevice

Roles             Select roles to be added to the user

Profiles          Select profiles to be added to the user

          When all necessary data has been entered, click the Save

    picture-icon.

5.               You will receive a User saved message in the status bar at the bottom of the screen.  You may now leave the SU01 transaction.

1.               Log on to the appropriate SAP system and the client where the user is to be changed.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the User name to be copied and click the double blank page picture-icon.

4.               On the Copy User popup, type in the To for the new user and click the Copy button.

5.               On the Maintain User screen, click on the tabs and make the changes to the user’s information.  When you are done, click the Save picture-icon.  You will receive a User saved message in the status bar at the bottom of the screen. 

6.               You may now leave the SU01 transaction.

 User

1.               Log on to the appropriate SAP system and the client where the user is to be changed.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user’s name and click the pencil picture-icon.

4.               On the Maintain User screen, click on the tabs and make your user information changes.  When you are done, click the Save picture-icon.

You will receive a User saved message in the status bar at the bottom of the screen.  You may now leave the SU01 transaction

1.               Log on to the appropriate SAP system and the client where the user is to be deleted.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user’s name and click the trash can picture-icon.

4.               On the Delete user popup, click the Yes button.

5.               You will receive a User deleted message in the status bar at the bottom of the screen.  You may now leave the SU01 transaction.

1.               Log on to the appropriate SAP system and the client where the user is to be locked.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user’s name and click the lock/unlock picture-icon.

4.               On the Lock user popup, click the lock picture-icon.

5.               You will receive a User locked message in the status bar at the bottom of the screen.  You may now leave transaction SU01.

1.               Log on to the appropriate SAP system and the client where the user’s password is to be changes.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user’s name and click the lock/unlock picture-icon.

4.               On the Change Password popup, enter the new password in both the New password and Repeat password boxes.  Click the green √ picture-icon.

5.               You will receive a The password was changed message in the status bar at the bottom of the screen.  You may now leave the SU01 transaction.

1.               Log on to the appropriate SAP system and the client where the user needs the role. Go to transaction SU01.

2.               On the User Maintenance: Initial Screen screen, type in the user’s name and press Enter to confirm that the user exists.

3.               Click the Change button or press Shift+F6.

4.               On the Maintain User screen, click on the Roles tab.  Fill in the name(s) in the field(s) provided, and when done press Enter.

5.               Click the Save button.

6.               Go to transaction PFCG, and on the Role Maintenance screen, type in the name of the role to which the users where added and press Enter to confirm exist of the role.

7.               Click the Change role little yellow pencil button. 

8.               On the Change Roles screen, click the User tab.  Click on User Comparison and then Complete Comparison.  Once the comparision is done, click Save one more time and you are done!

Making user changes one-at-a-time can be extremely time consuming not to mention boring.  SAP has provided mass change transaction to help eleviate the tediousness of making many user changes.  It should be noted, however, that the mass change transaction is limited as to the changes that can be made.  For example, you cannot change the password for multiple users.  Also note that it is best to make one type of mass change at a time.  For example, you need to add a new role to and delete an existing role from 20 users.  The best method to achieve this would be to first do a mass change to add the new role.  Save the changed users.  Then delete the existing role from the same 20 users. 

1.               Log on to the appropriate SAP system and the client where the user changes are to take place.

2.               Go to transaction SU10.

3.               On the User Maintenance: Mass Changes Initial Screen screen, you need to select whether you will select users based on Address Data or Authorization Data and click the appropriate button.  If you click Address Data, you can find users with any combination of First name, Last name, User ID, Company, City, Building, Room, Extension, Department, and Cost Center.  If you opt to use Authorization Data, you can specify a combination of Groups, Reference User, Authorizations, Athorization Objects, and many other fields.  For either method, fill in the fields you want to search on in the Users by Complex Selection Criteria screen, and click the Execute button.

4.               On the Users by Complex Selection Criteria screen, you can click “on” the users to be changed, or click the Select All button.  Once all the users you want to change have been selected, click the Transfer button.

5.               Back on the Maintenance: Mass Changes Initial Screen screen, you can select all the users on the screen again by clicking the Select All button or change your mind and make any last minute corrections.  Once you have all the users selected that you want to change, click User → Change.

6.               On the Mass User Changes screen, scroll through the tabs, changing data and clicking the Add or Remove button for each correction.  Please note, each SU10 batch run must use all Adds or all Removes but never a mixture.  Do all Adds in one run and then all Removes in another. Once all your changes have been made, click the Save button.

7.               On the Mass changes popup, you will see how many users you are about to change.  To make the changes, click on Yes. 

8.               On the Log Display screen, you will see a log of the changes you made.  Expand the list to see the transactional details.

9.               You may now leave the SU10 transaction.

1.               Log on to the appropriate SAP system and client where the user reports are to be generated.

2.               Go to transaction SUIM.

3.               On the User Information System screen, click the Infosystem authorizations entry on the navigation tree and click the double arrows pointing down picture-icon to expand the list of available reports.

4.               Click on the clock picture-icon to the left of the report you want to run.  You will be taken to a selection filter screen to customize the data you need to see on your report.  Once your report has been produced, you can print it or send it to your hard disk.

5.               You may now leave the SU01 transaction.

User Information Repository Reports

1.               Log on to the appropriate SAP system and client where the user reports are to be generated.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, from the top-most menu bar click Information → Information system.

4.               On the User Information System screen, click the Infosystem authorizations entry on the navigation tree and click the double arrows pointing down picture-icon to expand the list of available reports.

5.               Click on the clock picture-icon to the left of the report you want to run.  You will be taken to a selection filter screen to customize the data you need to see on your report.  Once your report has been produced, you can print it or send it to your hard disk.

6.               You may now leave the SU01 transaction.

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM04.

3.               On the User List screen, all users currently logged on to the SAP system are displayed.  To delete a user’s session, place a √ in the □ to the left of the user to be dropped and click the Sessions button.

4.               On the Overview of Sessions popup, click on the session No to be deleted.  Click the End Session button.

5.               You will not receive a deletion confirmation message.  You may now leave the SM04 transaction.

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM19.

3.               From the top-most menu bar on the Security Audit: Administer Audit Profile screen, click Profile → Create.

4.               On the Create new profile popup, type in a new Profile name and click the green √ picture-icon.

5.               On the Filter 1 tab of the Security Audit: Administer Audit Profile screen, click the □ to the left of Filter active to place a √ in the box.  In the Selection criteria section, select the Clients and User names to be traced.  In the Audit classes section, click “on” all the auditing functions you need for this profile.  In the Events section, click the radio button to the left of the level of auditing you need.  Once you have entered all your trace information, click the Save picture-icon.  You will receive an Audit profile saved in the status bar at the bottom of the screen.

6.               Please note that while the user trace has been saved, it is not yet active.  To activate the user trace, see the next section Activating a User Audit Profile.

7.               You may now leave the SM19 transaction.

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM19.

3.               On the Security Audit: Administer Audit Profile screen, select the audit profile to be activated from the Profile dropdown.  Click the lit match picture-icon to activate it.  You will receive an Audit profile activated for next system start in the status bar at the bottom of the screen.  The audit will not begin until after the SAP instance has been recycled.

4.               You may now leave the SM19 transaction.

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM19.

3.               On the Security Audit: Administer Audit Profile screen, select the audit profile to be deactivated from the Profile dropdown.  From the top-most menu bar, click the Profile → Deactivate.  You will receive a Current audit profile was deactivated in the status bar at the bottom of the screen. 

4.               You may now leave the SM19 transaction.

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM19.

3.               On the Security Audit: Administer Audit Profile screen, select the audit profile to be deleted from the Profile dropdown.  Click the trash can picture-icon.

4.               On the Confirmation prompt popup, click the Yes button.  You will receive an Audit profile deleted in the status bar at the bottom of the screen. 

5.               You may now leave the SM19 transaction.

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM20.

3.               In the Selection, Audit classes, and Events to select sections of the Security Audit Log: Local Analysis screen, provide your information to filter the audit information.  If you need to trace the activities of a specific user, be sure to include that user’s ID.  Click the Re-read audit log button.

4.               The resulting list is displayed.  This list can be printed using the usual methods.

5.               You may now leave the SM20 transaction.

Security Tasks

The easiest way to create a new user role is to copy an already existing user role, either one of your own or one of the ones provided to you in the installation of SAP.  So let’s assume that you have none of your own and use one of the SAP role templates provided.  It might assist you with picking one of these roles if you have someone dump the appropriate information into a spreadsheet containing the Role Name, Role Description, Transactions contained in the Role, and the Transaction description.  The SQL query would be something like this:

SELECT AGR_TEXTS.AGR_NAME, AGR_TEXTS.TEXT, AGR_TCODES.TCODE, TSTCT.TTEXT 
   FROM AGR_TEXTS, AGR_TCODES, TSTCT 
WHERE AGR_TEXTS.MANDT = ‘000′ AND 
   AGR_TEXTS.SPRAS = ‘E’ AND 
   AGR_TEXTS.LINE = 0 AND 
   AGR_TCODES.MANDT = ‘000′ AND 
   AGR_TCODES.AGR_NAME = AGR_TEXTS.AGR_NAME AND 
   TSTCT.SPRSL = ‘E’ AND 
   TSTCT.TCODE = AGR_TCODES.TCODE 
ORDER BY AGR_TEXTS.AGR_NAME, AGR_TCODES.TCODE;

This query should be changed based on the details of your SAP instance.  Identify the roles(s) to be used as the source for your role copy.

1.               Log on to client needing the role.

2.               Go to transaction PFCG.

3.               On the Role Maintenance screen, either type in the role name to be copied or select it from a dropdown.  Press Enter to confirm that the role exists.

4.               Click the Copy role button or press Shift+F11.

5.               One the Query popup box, fill in the to role field with the name to be given the new role.  Come up with a standard that everyone follows so the base original role is designated in some way so you don’t forget where you got the original.  The name must begin with Z or Y. Most people will add a Z- in the first two characters of the role name.  If you want to only select specific roles from a Composite role, you would click the Copy selectively button, otherwise click the Copy all button.

6.               Once the role has been copied, you will be taken back to the original PFCG screen where you will see the name of your new role.  Change you Role description and save the new role before working with it any further

1.               Log on to client needing the role change.

2.               Go to transaction PFCG.

3.               On the Role Maintenance screen, either type in the role name to be changed or select it from a dropdown.  Press Enter to confirm that the role is found.

4.               Click the Change Role little yellow pencil button role button or press F6.

5.               Click the Authorizations tab and then the Change Authorization Data button.

6.               On the Change Role: Authorizations screen, expand and change the authorizations you need to adjust.  When finished click first the Save button and then the Generate button – looks like a little red and white beachball.

7.               Back out to the Change Roles screen and click the User tab.  Click on User Comparison and then Complete Comparison.  Once the comparision is done, click Save one more time and you are done!

1.               Log on to client needing the role deletion.

2.               Go to transaction PFCG.

3.               On the Role Maintenance screen, either type in the role name to be changed or select it from a dropdown.  Press Enter to confirm that the role is found.

4.               Click the Role Delete button or Shift+F2.

5.               On the Delete Role popup, confirm that you wish to delete the deletion.  If you get an Information popup, confirm it also.

6.               Your deletion will return a successful message in the bottom status bar.

 (Transport System Method)

When a modification is made to a role in the 100 client, the roles must be transported to the 800 client.  One role, several roles, or all roles can be done if needed.  They can all be added to the same transport change request.  After the roles have been moved to other clients, you will need to log on to each of those clients and do a user comparison.  You will also need to do a text comparison in client 100 of the appropriate SAP system.

1.               Log on to client 100 of the appropriate SAP system.

2.               Go to transaction PFCG.

3.               On the Role maintenance screen, type in the Role name of the first role to be transported.  Click the Truck picture-icon.

4.               You will see an Information popup.  Click the green √ picture-icon.

5.               In the Choose objects popup, unclick the □s beside User assignment and Personalization.  If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment.  Click the green √ picture-icon.

6.               On the Prompt for Customizing request popup, click the blank page picture-icon to create a new change request.  On the Create Request popup, fill in the Short description and click the Save picture-icon.  You will be returned to the Prompt for Customizing request popup which contains the generated change request number for this system change. Click the green √ to continue.

7.               You will see a Data entered in change request message in the status bar at the bottom of the screen.  Now enter the name of the next role to be transported and click the Truck picture-icon.

8.               You will see an Information popup.  Click the green √ picture-icon.

9.               In the Choose objects popup, unclick the □s beside User assignment and Personalization. If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment. Click the green √ picture-icon.

10.           On the Prompt for Customizing request popup, continue to use the same transport you created in step 6.  Click the green √ to continue.

11.           Continue to perform steps 7 through 10 until all the roles you need to transport have been attached to the transport change request.

12.           The generated transport can now be released and transported into the clients needing the modified roles.

13.           You may now leave the PFCG transaction.

Transporting User Roles between Clients (Upload/Download Method)

Central User Administration distributes clients and their information to the other clients connected to the Distribution Model.  It does not, however, do the same for roles and role authorizations.  So when a modification is made to a role in the 100 client, the roles must be transported to the 800 client.  One role, several roles, or all roles can be done if needed.  They can all be added to the same transport change request.  After the roles have been moved to other clients, you will need to log on to each of those clients and do a user comparison.  You will also need to do a text comparison in client 100 of the appropriate SAP system.

1.               Log on to client 100 of the appropriate SAP system.

2.               Go to transaction PFCG.

3.               On the Role maintenance screen, type in the Role name of the first role to be transported.  Click the Truck picture-icon.

4.               You will see an Information popup.  Click the green √ picture-icon.

5.               In the Choose objects popup, unclick the □s beside User assignment and Personalization.  If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment.  Click the green √ picture-icon.

6.               On the Prompt for Customizing request popup, click the blank page picture-icon to create a new change request.  On the Create Request popup, fill in the Short description and click the Save picture-icon.  You will be returned to the Prompt for Customizing request popup which contains the generated change request number for this system change. Click the green √ to continue.

7.               You will see a Data entered in change request message in the status bar at the bottom of the screen.  Now enter the name of the next role to be transported and click the Truck picture-icon.

8.               You will see an Information popup.  Click the green √ picture-icon.

9.               In the Choose objects popup, unclick the □s beside User assignment and Personalization. If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment. Click the green √ picture-icon.

10.           On the Prompt for Customizing request popup, continue to use the same transport you created in step 6.  Click the green √ to continue.

11.           Continue to perform steps 7 through 10 until all the roles you need to transport have been attached to the transport change request.

12.           The generated transport can now be released and transported into the clients needing the modified roles.

13.           You may now leave the PFCG transaction.

Performing a User Comparison on the Modified Roles

1.               Log on to client 100 of the appropriate SAP system.

2.               Go to transaction PFCG.

3.               On the Role maintenance screen, type in the Role name of the first role to be transported.  Click the Change button.

4.               On the Change Roles screen, click the User tab.

5.               On the User tab, click the User compare button.

6.               On the Compare Role User Master Record popup, click the Complete compare button.

7.               You will receive a User master record for role was adjusted message in the status bar at the bottom of the screen.  You may now leave the PFCG transaction.

Performing a Text Comparison to Refresh Role Selection Lists

1.               Log on to client 100 of the appropriate SAP system.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user “model_user”.  Click the pencil picture-icon.

4.               On the Maintain User screen, click the Text comparison from child Syst. button.

5.               On the CUA: Text comparison from Child Systems screen, type “LSDEV100” for the Receiving system and “LSQAS800” for the to system.  This is a range, and since LSPRD300 falls alphabetically between LSDEV100 and LSQAS800, all three systems will have the text comparison performed.  Click the clock picture-icon.

6.               On the CUA: Text comparison from Child Systems results screen, you will see a list of the systems compared and the compare results.  Click the white arrow on green picture-icon 3 times, or until you have left the SU01 transaction.

Users, Roles, and Authorizations

SAP security is based on authorization objects and authorizations.  An authorization object is used to indicate that a user can perform a certain activity.  An authorization is used to limit the scope of that activity.

For example, a profile contains the S_DEVELOP authorization object.  This authorization object allows a user to perform ABAP workbench activities.  Some users will need to do all ABAP activites while others will only need to perform a few.  So S_DEVELOP has a selection of authorizations you can use:  ACTVT, DEVCLASS, OBJNAME, OBJTYPE, and P_GROUP.  The authorizations are set to the appropriate values as needed.  A tree view of the S_DEVELOP authorization object can be seen below:

            S_DEVELOP

                  ACTVT

                        Create or generate

                        Change

                        Display

                        Delete

                        Activate, generate

                        Execute

                        Create in DB

                        Delete in DB

                        Convert to DB

                        Administer

                        Copy

                        All Functions

                        Deactivate Mod. assistant

                  DEVCLASS

                        Single Value or Value Range

                  OBJNAME

                        Single Value or Value Range

                  OBJTYPE

                        Single Value or Value Range

                  P_GROUP

                        Single Value or Value Range

The S_DEVELOP authorization object in a profile lets a user perform ABAP workbench activities.  But having a S_DEVELOP authorization object with the ACTVT authorization value set to Display (03) means that the user is limited to display only in the ABAP workbench transactions.  Thus we see that authorization objects grant while authorizations limit.  It is important to remember, however, that a user with a profile having a S_DEVELOP with full authorizations still cannot access an ABAP workbench transaction until a matching S_TCODE (start up transaction code) has been added as well.  In other words, a user may have the rights to add, modify and delete ABAP programs but until an entry for SE38 has been added to the S_TCODE authorization object, he cannot access transaction SE38 which is the ABAP Editor.

All authorization objects and authorizations are grouped into profiles before being attached to users.  Profiles use a combination of authorization objects and their respective authorizations, and their creation can be complex as well as tedious.  In order to simplify the creation of profiles, the Profile Generator (transaction PFCG) was created.  Roles are created via a more user-friendly interface which generates profiles based on the information added via this interface.

Manually creating profiles is the “old” way of doing things.  There are times, such as the start of a new SAP landscape where no roles exist, that the use of profiles is handy.  But once the landscape has been completed all users, with the exception of the Basis team, should be attached to roles.  There should never be a need to manually create a SAP new profile.  To add a new role, the easiest method is to copy an existing role that matches your needs as closely as possible and make the changes you need for the new role.

This documentation covers changing user security via both methods.

Adding Authorization Objects and/or Authorizations to a Profile

Remember that profiles are NOT the standard way to implement SAP security

1.               Log on to the appropriate client in the appropriate SAP system.

2.               Go to transaction SU02.

3.               In the Manually edit authorization profiles section of the Profile: Initial Screen screen, enter the Profile you want to change.  Make sure the Active only □ is checked.  Click the Create work area for profiles button.

4.               On the Profile List screen, double-click the profile to be changed.

5.               A profile can contain authorization objects only (single profile) or one or more other profiles (collective profile).  If the next screen is titled Maintain Profile, this is a single profile, and you should proceed to the next step.  If the next screen is titled Collect Profiles, this is a collective profile and you should skip to step 13.

6.               On the Maintain Profile screen, you must decide if you need to add a new authorization object and one or more of its authorizations, or add a new authorization to an authorization object already in the profile.  If you need to add a new authorization to an authorization object already in the profile, skip to step 7.  Otherwise, scroll down the Consisting of authorizations list until you find a blank line.  Type the authorization object you need to add and press Enter.  You will need to scroll through the list again until you find the authorization object you just added (it is was to find since the Authorization column should still be blank).  Once you find the new entry line, use the drop down to fill in the Authorization column.  Click on the Save picture-icon.

7.               If you need to add another authorization to an authorization object already in the profile list, click on the +Add authorization button. 

8.               From the Maintain Profiles: Object Classes screen, double-click the Object class of the authorization you are adding. 

9.               On the Maintain Profiles: List of Authorizations screen, select the authorization you need to add by double-clicking the appropriate line.  This will return you to the Maintain Profile screen where you can see that your authorization has been added.

10.           On the Maintain Profile screen, click the Save picture-icon.  Then click the lit match picture-icon to activate the new profile changes.

11.           On the Activate Profile: Execution Screen screen, click on the lit match picture-icon to complete the profile activation process.

12.           You may now leave the SU02 transaction.

13.           In order the change a profile collection, you must make the changes in one or more of the dependent profiles, save the changes in the dependent profile(s), activate the dependent profile(s), save the collection owner profile, and activate the collection owner profile.  On the Collect Profiles screen, double-click on the profile you want to change.

14.           You will be taken to the Maintain Profile screen.  Perform steps 6 to 11.  Then use the white arrow on green picture-icon to go back.

15.           On the Collect Profiles screen, click the Save picture-icon.  Then click the lit match picture-icon to activate the new profile changes.

16.           On the Activate Profile: Execution Screen screen, click on the lit match picture-icon to complete the profile activation process.

17.           You may now leave the SU02 transaction.

Adding Authorization Objects and/or Authorizations to a Role

1.               Log on to client 100 in the DEV SAP system.

2.               Go to transaction PFCG.

3.               On the Role Maintenance screen, enter the Role you want to change.  Click the Change button.

4.               On the Change Role screen, click the Authorizations tab and then click the pencil picture-icon.

5.               If you are only adding a start up transaction to the role, skip to step 10.  Otherwise, the assumption is that a new authorization object is to be added. On the Change role: Authorizations screen, click the +Manually button.

6.               On the Manual selection of authorizations popup, enter the authorizations objects that need to be added (ie S_DEVELOP, S_PROGRAM, etc.)  Click the green √ when you are finished.

7.               Back on the Change role: Authorizations screen, if all the displayed signal lights are green, skip to step 8.  Otherwise, fully expand the lines that are yellow and/or red and supply the necessary information.  All signal lights should be green before moving to the next step.

8.               On the Change role: Authorizations screen, click the Save picture-icon.  You will receive a Data saved confirmation message in the status bar at the bottom of the screen.

9.               On the Change role: Authorizations screen, click the red-and-white beach ball picture-icon to generate a profile from the saved role.  Reply affirmatively if any confirmation popups.  You will receive a Profile(s) created message in the status bar at the bottom of the screen.  If you do not need to add any start up transactions to the profile, you may now leave the PFCG transaction.

10.           On the Change Role: Authorizations screen, expand the Cross-application Authorization Objects → Authorization Check for Transaction Start → Authorization Check for Transaction Start until you see the Transaction code entry line.  Double-click on the entry portion of the Transaction code line.

11.           In the Maintain Field Values popup, scroll down the list until you find a blank From and To line.  Enter the transaction(s) to be added, and click the Save picture-icon when you have finished. 

12.           On the Change role: Authorizations screen, click the Save picture-icon.  You will receive a Data saved confirmation message in the status bar at the bottom of the screen.

13.           On the Change role: Authorizations screen, click the red-and-white beach ball picture-icon to generate a profile from the saved role.  Reply affirmatively if any confirmation popups.  You will receive a Profile(s) created message in the status bar at the bottom of the screen. 

14.           You may now leave the PFCG transaction.

*** Since SAP R/3 4.5, this is not the standard for user authorizations.

***

Granting Transaction Access to a User via Role

1.        Log on to the applicable SAP instance and client.

2.        Go to transaction SU01.

3.        On the User Maintenance: Initial Screen screen, fill in the User ID for the user you want to change, either by typing it in or choosing it from the drop down.  Click the little yellow pencil Change button.

4.        On the Maintain User screen, click on the Roles tab.  Fill in the new role in the first available Role field.  Press ENTER to confirm that the role exists.  Click the Save button.

5.        Make sure to use transaction PFCG to run a user comparion to rebuilt the role-to-user connections.

6.        You may now leave the PFCG transaction.

*** Since SAP R/3 4.5, this is not the standard for user authorizations.

***

Revoking Authorizations from a User via Role

Use the same procedure as Adding Authorization Objects and/or Authorizations to a

Role

Revoking Transaction Access from a User via Profile

*** Remember that profiles are NOT the standard way to implement SAP security. ***

Attaching a Profile to a User

*** Since SAP R/3 4.5, this is not the standard for user authorizations.

***

Attaching a Role to a User

1.        Log on to the applicable SAP instance and client.

2.        Go to transaction SU01.

3.        On the User Maintenance: Initial Screen screen, fill in the User ID for the user you want to change, either by typing it in or choosing it from the drop down.  Click the little yellow pencil Change button.

4.        On the Maintain User screen, click on the Roles tab.  Fill in the new role in the first available Role field.  Press ENTER to confirm that the role exists.  Click the Save button.

5.        Make sure to use transaction PFCG to run a user comparion to rebuilt the role-to-user connections.

6.        You may now leave the PFCG transaction.

Client Tasks

*** SAP’s terms for the sending and receiving clients can be confusing.  The “target” client is the client into which data is to be copied.  The “source” client is the client which contains the data to be copied.  Also, remember that all client copies are destructive and will delete all data before copying in the new data.  The only exception is when the SAP_USER profile is used.  In this case, only user master data is deleted from the target client before the new user master data is copied.  ***

1.               Create the target client if necessary.

2.               Log on to the target client in the appropriate SAP system.  If the target client is new, use “SAP*” for the user and “pass” for the password.

3.               Go to transaction SCCL for Local Client Copy.

4.               On the Client Copy – Copy a Client screen, use the Selected profile dropdown to select a profile that matches your needs.  Use SAP_ALL or SAP_UAPP to copy all data except change documents, SAP_USER to copy only user master data, or one of the other SAP provided client copy profiles. Type the Source client and Source client user masters in the provided boxes.  These two boxes should contain the same client number unless the data is to come from one client and the user master data from a different client.  Once all information has been provided, click the Schedule as background job button.  If you receive a Change documents will not be copied message in the bottom status bar, click the green √ next to the transaction command field at the very top of the screen to continue.

5.               On the Schedule Client Copy in Background screen, use the Background server dropdown to select the background server on which the job is to run.  There should only be one server available in the dropdown.  Click the Schedule job button.

6.               On the Verification popup, check that everything is correct and click the Continue button.

7.               On the Start Time popup, if you want the client copy job submitted right away, click the Immediate button.  To schedule the copy for a later date and/or time, click the Date/Time button.  In the Date/Time section, provide the Scheduled start Date and Time.  If you are unsure as to the format of date and time, click on the top-most menu bar System → User profile → Own data.  Click on the Defaults tab to see your default date format.  If the user is SAP* due to a new client, you may receive a date validation error if you use the date format of MM-DD-YYYY.  Try other variations such as DD.MM.YYYY, MM/DD/YYYY, YYYY.MM.DD, YYYY/MM/DD, and YYYY-MM-DD.  Click the Save picture-icon.

8.               On the Background Print Parameters popup, select an Output device from the dropdown.  Click the green √ to continue.

9.               You will receive a client copy confirmation message.  You can monitor this copy by using transaction SCC3.  You may now leave the SCCL transaction.

*** SAP’s terms for the sending and receiving clients can be confusing.  The “target” client is the client into which data is to be copied.  The “source” client is the client which contains the data to be copied.  Also, remember that all client copies are destructive and will delete all data before copying in the new data.  The only exception is when the SAP_USER profile is used.  In this case, only user master data is deleted from the target client before the new user master data is copied.  ***

1.               Create the target client if necessary.

2.               Log on to the target client in the appropriate SAP system.  If the target client is new, use “SAP*” for the user and “pass” for the password.

3.               Go to transaction SCC9 for Remote Client Copy.

4.               On the Client Copy – Copy a Client screen, use the Selected profile dropdown to select a profile that matches your needs.  Use SAP_ALL or SAP_UAPP to copy all data except change documents, SAP_USER to copy only user master data, or one of the other SAP provided client copy profiles. Since this is a client copy that uses data from a client in another SAP system (or remote client), a Source destination must be provided.  This is a RFC connection pointing to a specific client in another SAP system.  If there is no RFC connection to the client you wish to copy, you will need to create one.  Otherwise, use the dropdown to select the remote source client.  To test that your select Source destination RFC connection will work, click the RFC system check button. Once the proper remote source client has been selected, the System name and Source client boxes will fill automatically.  Once all information has been provided, click the Schedule as background job button.  If you receive a Change documents will not be copied message in the bottom status bar, click the green √ next to the transaction command field at the very top of the screen to continue.

5.               On the Schedule Client Copy in Background screen, use the Background server dropdown to select the background server on which the job is to run.  There should only be one server available in the dropdown.  Click the Schedule job button.

6.               On the Verification popup, check that everything is correct and click the Continue button.

7.               On the Start Time popup, if you want the client copy job submitted right away, click the Immediate button.  To schedule the copy for a later date and/or time, click the Date/Time button.  In the Date/Time section, provide the Scheduled start Date and Time.  If you are unsure as to the format of date and time, click on the top-most menu bar System → User profile → Own data.  Click on the Defaults tab to see your default date format.  If the user is SAP* due to a new client, you may receive a date validation error if you use the date format of MM-DD-YYYY.  Try other variations such as DD.MM.YYYY, MM/DD/YYYY, YYYY.MM.DD, YYYY/MM/DD, and YYYY-MM-DD.  Click the Save picture-icon.