Hide the User Menu

Is there a way of masking or hiding the User Menus as we are using SAP Standard Menu instead of User Based Menus?

To put it simple, when the user logs on to the system he should have only the SAP Standard Menu. 
You have two ways to control this :
1.  Default hide for all the SAP users.
Goto SM30 and edit the table SSM_CUST and set ALL_USER_MENUS_OFF = YES and transport the same in production server.
or
2.  Hide based on individual SAP users.
you can also try SM30 and maintain table USERS_SSM for individual users.

View and Delete All Single and Composite Role

We have done some changes in production role for single as well as composite role.  How to delete all the single as well as composite role at one time?


Run transaction SU10 and select multiple role single and composite and delete on single click of button:

Is there any way to view the composite roles that were assigned to a user that was deleted? 
I am able to go to SUIM and view the single roles but I would like to get the composite roles that were deleted. This is needed so that we can recreate the user and assign the old roles to the user.




If you select the "role change docs" in SUIM and use the selection criteria "overview of change docs" or "all change docs", then deleted composite roles will show up in this report. It would be handy if your composite roles had a different naming convention than the single roles.

How to delete expired roles?

Here are 3 notes you may want to review to see if there is any helpful info, plus some documentation that may be helpful for others....we are going from 40B to 47 and have had a few issues with role deletion 
Notes: 312943 504412 & 313587
Additional info
First, the report PFCG_TIME_DEPENDENCY is functioning as designed.  It was not designed to remove activity groups.
Second, in transaction SU10 you must have the valid from and valid to fields filled in with the actual dates, 04/08/2002, in order to remove the invalid activity group.  You need to be sure that the remove user radio button set in the role tab. But in the profile tab, the add user radio button is selected by default. What you have to do is go to profile tab and select the remove user radio button. You have to make sure both role and profile has the same radio button selected, i.e. remove from users. Only then when you click save, it will allow you to delete the role from user.  


In transaction SU10, you need to complete the following steps:
1.  Click on the Authorization data button.
2.  Entry the users name, latimerc
3.  Click on the execute button.
4.  Put a check in front of the users name.
5.  Click on the transfer button.
6.  Now highlight the user.
7.  Click on the pencil button.
8.  Click on the Activity Groups tab.
9.  Enter the profile name (PM_NOTIFICATION_PROCESSOR).
10. Enter the valid from and valid to dates (04/08/2002).
11. Change the radio buttons to remove user from both the Activity Group and Profile Tabs.
12. Click on the trash can.


In another customer message the following was provided by developement:
We don't have a regular functionality for mass deletion of roles.  But if you want to avoid the deletion by hand or with an own created report, I would suggest the following:
The attached note 324962 includes the report ZDELETE_RY_T_AGRS which could delete all roles with names like 'T_....' or 'RY....'. The report gives you a list of all these roles and deletes then the selected ones. You can modify the report to get all your roles in the selection list. Therefore you have to change the following:


SELECT * FROM AGR_FLAGS INTO TABLE L_AGR_FLAGS
                     WHERE FLAG_TYPE = 'COLL_AGR'
                     AND   FLAG_VALUE = 'X'.
SORT L_AGR_FLAGS BY AGR_NAME.
LOOP AT SINGLE_ACTGROUPS WHERE AGR_NAME+11 <> SPACE AND   <<< delete
          ( AGR_NAME(2) = 'T_' OR AGR_NAME(2) = 'RY' ).   <<< delete
LOOP AT SINGLE_ACTGROUPS WHERE AGR_NAME+11 <> SPACE.      <<< insert
 READ TABLE L_AGR_FLAGS WITH KEY AGR_NAME = SINGLE_ACTGROUPS-AGR_NAME
                            BINARY SEARCH.


Text from an additional customer message as further help:
- go on role tab
- select remove from user
- enter ZR.PRD.GENERIC and date : 06/04/2002 12/31/9999
- go to profile tab
- select remove from user
- save
- do the same for ZR:HR:ESS from 01/01/2002 to 12/31/9999 and worked
  from date for testid was 01/01/2002 and testid2 02/01/2002 and the 2 assignement were deleted And the roles were 
  removed from the 2 UMR.
So it works as designed. 

Mass Maintenance of Users Profiles

Goto transaction code SU10
Select your SAP User by Address data or Authorization data.
With the users you want to change selected, click :-
User -> Change -> Profiles
Filled in the Profiles and click save.

Changing the default password for sap* user

You are trying to change the password for sap* user, however when you go into su01 and enter sap* as the user name, the following message is displayed, user sap* does not exist.

You can delete the SAP* user using ABAP code :-
Delete from usr02 where bname = 'SAP*' and mandt = '***';
Where '***' means your client no.

Then login to your client using password SAP* and password PASS
However, if you delete it, then it will automatically created once again with password PASS
The userid, SAP*, is delivered with SAP and is available in clients 000 and 001 after the initial installation. In these 2 clients, the default password is 07061992 (which is, by the way, the initial date when R/3 came into being...). It is given the SAP_ALL user profile and is assigned to the Super user group. When I say it is "delivered" with SAP, I mean that the userid resides in the SAP database; there are actually rows in the user tables used to define userids.

If you delete the userid, SAP*, from the database, SAP has this userid defined in its kernel (the SAP executable code that sits at the operating system level, i.e., disp+work).  When this situation exists, the password defined in the SAP code for SAP* is PASS.  This is necessary when you are performing client copies for example, as the user information is copied at the end of the process. You can sign into the client you are creating while a client copy is processing using SAP* with password PASS (but you should have a good reason to do this - don't change anything while it's running).

Anyway, if the SAP* userid is missing, you can sign in to the client you want and simply define it using transaction SU01 and, as I stated above, assign it to the SUPER user group and give it the SAP_ALL profile.  You define its initial password at this point. If you've forgotten its password and don't have a userid with sufficient authorization to create/change/delete userid, 

then you can use the SQL statements to delete it from the database and then you can use SAP* with PASS to sign back into the client you want to define it in and recreate it.

There is also a profile parameter which can override the use of SAP* with PASS to close this security hole in SAP (login/no_automatic_user_sapstar).  When this parameter is defined either in your DEFAULT.PFL profile or the instance-specific profile and is set to a value of '1', then the automatic use of SAP* is deactivated. The only way to reactivate the kernel-defined SAP* userid at this point would be to stop SAP, change this parameter to a value of 0 (zero), and then 
restart SAP.
The default password for SAP* is 06071992. (DDIC has 19920706)

Different methods to Lock or unlock SAP users

I want to lock all the users in SAP during MTP.  I know using SU10 we can do it. Any other alternative ways to lock the users.
Is there a way in SAP to unlock a locked user for a limited time, then automatically after x time set the user back to lock status? 
You can fill in "valid from" and "valid until", but you cannot say from Monday to Friday from 8 - 12:00 for part time workers.
Can we schedule to lock all users?
If users get locked, from SU01 you can unlock them.
Use SU10 to mass lock/unlock the users.
Use address data or authorisation data to get a list of users - select the ones you want and
click transfer.
Once this is done click on lock or unlock.
You can also use transaction code EWZ5 to mass lock/unlock the users
or
Execute program EWULKUSR in SE38
or
Set a profile parameter (login/failed_user_auto_unlock) to unlock at midnight the locked users.
or
Here's an ABAP code, short and simple, isn't it?
REPORT zreusrlock.
DATA: time_limit TYPE sy-datum. 
DATA: days TYPE i VALUE 40.
time_limit = sy-datum - days. 
UPDATE usr02 SET uflag = 64 WHERE trdat < time_limit.
If you don't want to specify the time in the program, you can use SE38 to schedule it as a daily background job with the date and time.
or
Probably the easiest way would be to write a sqlplus SQL script that sets all the UFLAG fields in table USR02 to 64 EXCEPT for the BNAMEs you don't want locked. When you are done, you can do the same again but change the UFLAG field to 0.
The SQL statement would look like:
update SAPR3.USR02 set UFLAG = 64 where MANDT = <client number> and BNAME != <don't lock user 1> 
AND BNAME != <don't lock user 2>;
You can replace != with <> if you want. To run this from an OS command line, you would type:
Unix/Oracle 8---> sqlplus internal @<SQLpath+SQLname> 
NT/Oracle 8.0---> plus80 internal @<SQLpath+SQLname> 
NT/Oracle 8.1---> sqlplus internal @s<SQLpath+SQLname> 
Unix/Oracle 9:--> sqlplus /nolog @<SQLpath+SQLname> 
NT/Oracle 9-----> sqlplus /nolog @<SQLpath+SQLname>
In UNIX you can cron the script to schedule it. In NT you can schedule it as a task.
or
This is another method to UNLOCK ALL users.
Start Oracle Server manager (I assume you are on Oracle) 
connect internal 
update sapr3.usr02 set uflag='0' where mandt='399';
When users are locked, the uflag is set to 64.
Finish, just query to check.
select bname, uflag from sapr3.usr02 where mandt='399';
Please note that unlocking users from low level (like Oracle sqlplus) should be used as last resort. Frequent use of low level access may tempt you to use on other things. Highly dangerous and your IS auditors will not be too happy.
Is there a way to set a list of users that cannot be locked, even if we try to lock them manually, and even if they fail connection ( wrong password )?
Increase this parameter in SAP Instance profile:
login/fails_to_user_lock = 6 (max is 99 wrong attempts, i.e, value 99). Currently you have a value of 3.
login/failed_user_auto_unlock (for your midnight unlocking).
Ask users to remember passwords!! If someone is deliberately login-in with different username/password (thereby blocking legitimate access of that user), check hostname from SM21.
This is considered as DoS (Denial of Service).

Frequently Used UNIX Commands in SAP

Top 10 fundamental commands which are commanly used in Unix OS.
1. stopsap/startsap for stopping/starting SAP+ DB, stopsap r3/startsap r3 for stopping/starting R3
2. cdpro for checking the profiles path SAPMNT/<SID>/profile
3. cdexe for checling the kernel folder
4. find . -name filename -print for checking the file in the present directory
5. dpmon pf= <Instance profile path>, jcmon pf=<instance profile path>
6. df -k, bdf for checking all file system usages; df -k ., bdf. for individual file usages
7. ls -lrt for listing of files according to the date modified
8. du -a | sort -k 1n,1 for sorting the files in a recursive manner.
9. h for listing previous used commands.
10. rm < file> for removing file, gzip <file> for zipping the file.
-----
1. VI and Gedit is an Editor,  just like to write any programme save it and go to command and compile through through GCC -o .cpp 
2. Ps -ef is to check the how many running process and Kill any running process
3. gunzip to unzip file
4. tar -xvzf file name to run the zip folder of file content
5. mv mo from one path to another
6. Rf remove forcifully any file
7. Make command to effect any coading content
8. make clean to clean the effect of make command
9. cp coppy from one location to another
10. pwd check the current directory
-----
Check these commands.
su - production-admin 
stopsap all -> make sure that the R/3 Instance and Oracle Database stopped 
startsap all -> make sure that the R/3 Instance and Oracle Database started
If the Oracle Database is not started, tried using SAPDBA 
su - oracle-admin 
sapdba 
Options a - Startup / Shutdown Database instance