Top 26 SAP Security Interview Questions

1) Explain what is SAP security?

SAP security is providing correct access to business users with respect to their authority
or
responsibility and giving permission according to their roles.
2) Explain what is roles in SAP security?
Roles is referred to a group of t-codes, which is assigned to execute particular
business task.
Each role in SAP requires particular privileges to execute a function in SAP that is called
AUTHORIZATIONS.
3) Explain how you can lock all the users at a time in SAP?
By executing EWZ5 t-code in SAP, all the user can be locked at the same time in SAP.
4) Mention what are the pre-requisites that should be taken before assigning
Sap_all to a
user even there is an approval from authorization controllers?
Pre-requisites follows like
Enabling the audit log- using sm 19 tcode
Retrieving the audit log- using sm 20 tcode
5) Explain what is authorization object and authorization object class?
Authorization Object: Authorization objects are groups of authorization field that
regulates particular activity. Authorization relates to a particular action while
Authorization field relates for security administrators to configure specific values in that
particular action.
Authorization object class: Authorization object falls under authorization object
classes, and they are grouped by function area like HR, finance, accounting, etc.
1/5

6) Explain how you can delete multiple roles from QA, DEV and Production
System?
To delete multiple roles from QA, DEV and Production System, you have to follow below
steps
Place the roles to be deleted in a transport (in dev)
Delete the roles
Push the transport through to QA and production
This will delete all the all roles
7) Explain what things you have to take care before executing Run System Trace?
If you are tracing batch user ID or CPIC, then before executing the Run System Trace,
you
have to ensure that the id should have been assigned to SAP_ALL and SAP_NEW. It
enables
the user to execute the job without any authorization check failure.
8) Mention what is the difference between USOBT_C and USOBX_C?
USOBT_C: This table consists the authorization proposal data which contains the
authorization data which are relevant for a transaction
USOBX_C: It tells which authorization check are to be executed within a transaction
and

which must not

9) Mention what is the maximum number of profiles in a role and maximum
number of
object in a role?
Maximum number of profiles in a role is 312, and maximum number of object in a role is
150.
2/5

10) What is the t-code used for locking the transaction from execution?
For locking the transaction from execution t-code SM01, is used.
11) Mention what is the main difference between the derived role and a single
role?
For the single role, we can add or delete the t-codes while for a derived role you cannot
do that.
12) Explain what is SOD in SAP Security?
SOD means Segregation of Duties; it is implemented in SAP in order to detect and
prevent
error or fraud during the business transaction. For example, if a user or employee has
the
privilege to access bank account detail and payment run, it might be possible that it can
divert
vendor payments to his own account.
13) Mention which t-codes are used to see the summary of the Authorization
Object and
Profile details?
SU03: It gives an overview of an authorization object
SU02: It gives an overview of the profile details
14) Explain what is User Buffer?
A user buffer consists of all authorizations of a user. User buffer can be executed by tcode
SU56 and user has its own user buffer. When the user does not have the necessary
authorization or contains too many entries in his user buffer, authorization check fails.
15) By which parameter number of entries are controlled in the user buffer?
In user buffer number of entries are controlled by the profile parameter
Auth/auth_number_in_userbuffer.
16) How many transactions codes can be assigned to a role?
To a role maximum of 14000 transaction codes can be assigned.
17) Mention which table is used to store illegal passwords?
To store illegal passwords, table USR40 is used, it is used to store pattern of words
which
cannot be used as a password.
18) Explain what is PFCG_Time_Dependency ?
PFCG_TIME_DEPENDENCY is a report that is used for user master comparison. It also
clears
up the expired profiles from user master record. To directly execute this report PFUD
transaction code can also be used.
3/5

http://career.guru99.com/

19) Explain what does USER COMPARE do in SAP security?

In SAP security, USER COMPARE option will compare the user master record so that
the
produced authorization profile can be entered into the user master record.
20) Mention different tabs available in PFCG?
Some of the important tab available in PFCG includes
Description: The tab is used to describe the changes made like details related to the
role, addition or removal of t-codes, the authorization object, etc.
Menu: It is used for designing user menus like addition of t-codes
Authorization: Used for maintaining authorization data and authorization profile
User: It is used for adjusting user master records and for assigning users to the role
21) Which t-code can be used to delete old security audit logs?
SM-18 t-code is used to delete the old security audit logs.
22) Explain what reports or programs can be used to regenerate SAP_ALL
profile?
To regenerate SAP_ALL profile, report AGR_REGENERATE_SAP_ALL can be used.
23) Using which table transaction code text can be displayed?
Table TSTCT can be used to display transaction code text.
24) Which transaction code is used to display the user buffer?
User buffer can be displayed by using transaction code AL08
25) Mention what SAP table can be helpful in determining the single role that is
assigned
to a given composite role?
Table AGR_AGRS will be helpful in determining the single role that is assigned to a
given
composite role.
26) What is the parameter in Security Audit Log (SM19) that decides the number
of
filters?
Parameter rsau/no_of_filters are used to decide the number of filters.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

SAP Security Interview Questions and

answers

Published by admin On July 03, 2014

Question.1 Please explain the personalization tab within a role?

Answer: Personalization is a way to save information that could be common to users, I meant
to a user role E.g. you can create SAP queries and manage authorizations by user groups.
Now this information can be stored in the personalization tab of the role. (I supposed that it is a
way for SAP to address his ambiguity of its concept of user group and roles: is usergroup a
grouping of people sharing the same access or is it the role who is the grouping of people sharing
the same access).
Question.2 Is there a table for authorizations where I can quickly see the values entered in
a group of fields?
Answer: In particular I am looking to find the field values for P_ORGIN across a number of
authorization profiles, without having to drill down on each profile and authorization.
AGR_1251 will give you some reasonable info.
Question.3 How can I do a mass delete of the roles without deleting the new roles ?
Answer: There is a SAP delivered report that you can copy, remove the system type check and
run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete
program or manually delete and then release the transport and import them into all clients and
systems.
It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS. To used it, you need to tweak/debug
& replace the code as it has a check that ensure it is deleting SAP delivered roles only. Once you
get past that little bit, it works well.
Question.4 Someone has deleted users in our system, and I am eager to find out who. Is
there a table where this is logged?
Answer: Debug or use RSUSR100 to find the infos.
Run transaction SUIM and down its Change documents.
Question.5 How to insert missing authorization?
Answer: su53 is the best transaction with which we can find the missing authorizations.and we
can insert those missing authorization through pfcg.
Question.6 What is the difference between role and a profile?

Answer: Role and profile go hand in hand. Profile is bought in by a role. Role is used as a
template, where you can add T-codes, reports..Profile is one which gives the user authorization.
When you create a role, a profile is automatically created.
Question.7 What profile versions?
Answer: Profile versions are nothing but when u modifies a profile parameter through a RZ10
and generates a new profile is created with a different version and it is stored in the database.
Question.8 What is the use of role templates?
Answer: User role templates are predefined activity groups in SAP consisting of transactions,
reports and web addresses.
Question.9 What is the different between single role & composite role?
Answer: A role is a container that collects the transaction and generates the associated profile.
A composite roles is a container which can collect several different roles
Question.10 Is it possible to change role template? How?
Answer: Yes, we can change a user role template. There are exactly three ways in which we
can work with user role templates
- we can use it as they are delivered in sap
- we can modify them as per our needs through pfcg
- we can create them from scratch.
For all the above specified we have to use pfcg transaction to maintain them.
Question.11 SAP Security T-codes?
Answer:
Frequently used security T-codes
SU01 Create/ Change User SU01 Create/ Change User
PFCG Maintain Roles
SU10 Mass Changes
SU01D Display User

SUIM Reports
ST01 Trace
SU53 Authorization analysis
Question.12 How to create users?
Answer: Execute transaction SU01 and fill in all the field. When creating a new user, you must
enter an initial password for that user on the Logon data tab. All other data is optional. Click here
for turotial on creating sap user id.
Question.13 What is the difference between USOBX_C and USOBT_C?
Answer: The table USOBX_C defines which authorization checks are to be performed within a
transaction and which not (despite authority-check command programmed ). This table also
determines which authorization checks are maintained in the Profile Generator. The table
USOBT_C defines for each transaction and for each authorization object which default values
an authorization created from the authorization object should have in the Profile Generator.
Question.14 What authorization are required to create and maintain user master records?
Answer: The following authorization objects are required to create and maintain user master
records: S_USER_GRP: User Master Maintenance: Assign user groups
S_USER_PRO: User Master Maintenance: Assign authorization profile
S_USER_AUT: User Master Maintenance: Create and maintain authorizations
Q.List R/3 User Types
A.1.Dialog users are used for individual user. Check for expired/initial passwords Possible to
change your own password. Check for multiple dialog logon
2.A Service user Only user administrators can change the password. No check for
expired/initial passwords. Multiple logon permitted
3.System users are not capable of interaction and are used to perform certain system activities,
such as background processing, ALE, Workflow, and so on.
4.A Reference user is, like a System user, a general, non-personally related, user. Additional
authorizations can be assigned within the system using a reference user. A reference user for
additional rights can be assigned for every user in the Roles tab.
Question.15 What is a derived role?

Answer: Derived roles refer to roles that already exist. The derived roles inherit the menu
structure and the functions included (transactions, reports, Web links, and so on) from the role
referenced. A role can only inherit menus and functions if no transaction codes have been
assigned to it before.
The higher-level role passes on its authorizations to the derived role as default values which can
be changed afterwards. Organizational level definitions are not passed on. They must be created
anew in the inheriting role. User assignments are not passed on either.
Derived roles are an elegant way of maintaining roles that do not differ in their functionality
(identical menus and identical transactions) but have different characteristics with regard to the
organizational level.
Question.16 What is a composite role?
Answer: A composite role is a container which can collect several different roles. For reasons of
clarity, it does not make sense and is therefore not allowed to add composite roles to composite
roles. Composite roles are also called roles.
Composite roles do not contain authorization data. If you want to change the authorizations (that
are represented by a composite role), you must maintain the data for each role of the composite
role.
Creating composite roles makes sense if some of your employees need authorizations from
several roles. Instead of adding each user separately to each role required, you can set up a
composite role and assign the users to that group.
The users assigned to a composite role are automatically assigned to the corresponding
(elementary) roles during comparison.
Question.17 What does user compare do?
Answer: If you are also using the role to generate authorization profiles, then you should note
that the generated profile is not entered in the user master record until the user master records
have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY
on.
Question.18 How do I change the name of master / parent role keeping the name of
derived/child role same? I would like to keep the name of derived /child role same and
also the profile associated with the child roles.?
Answer: Firstcopy the master role using PFCG to a role with new name you wish to have. Then
you have to generate the role. Now open each derived role and delete the menu. Once the menus
are removed it will let you put new inheritance. You can put the name of the new master role you
created. This will help you keep the same derived role name and also the same profile name.

Once the new roles are done you can transport it. The transport automatically includes the Parent
roles.
Question.19 What is the difference between C (Check) and U (Unmentioned)?
Answer: Background: When defining authorizations using Profile Generator, the table
USOBX_C defines which authorization checks should occur within a transaction and which
authorization checks should be maintained in the PG. You determine the authorization checks
that can be maintained in the PG using Check Indicators. It is a Check Table for Table
USOBT_C.
In USOBX_C there are 4 Check Indicators.
CM (Check/Maintain)
-An authority check is carried out against this object.
-The PG creates an authorization for this object and field values are displayed for changing.
-Default values for this authorization can be maintained.
C (Check)
-An authority check is carried out against this object.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization.
N (No check)
-The authority check against this object is disabled.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization.
U (Unmaintained)
-No check indicator is set.
-An authority check is always carried out against this object.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

SAP Security interview Questions:

1. 1.

What is the user type for a background jobs user?

Ans: 1system user, 2.communication user

1. 2.

How to trouble shoot problems for background user

Ans: using system Trace ST01

1. 3.
There are two options in the PFCG while modifying a role. One change
authorizations and another expert mode-what is the difference between them
Ans: Change authorization: This option we will use when we create new role and modify
old role
Expert mode: i. Delete and recreate authorizations and profile
(All authorizations are recreated. Values which had previously been maintained, changed
or entered manually are lost. Only the maintained values for organizational levels remain.)
ii. Edit old status
(The last saved authorization data for the role is displayed. This is not useful, if
transactions in the role menu have been changed.)
iii. Read old data and merge with new data

(If any changes happen in SU24 Authorizations we have to use this)

1. 4.
If we give Organizational values as * in the master role and want to restrict
the derived roles for a specific country, how do we do?
Ans: we have to maintain org level for the country based on the plant and sales area etc in
the derived Role
1. 5.

What is the table name to see illegal passwords?

Ans: USR40
1. 6.

What is the table name to see the authorization objects for a user

Ans: USR12

1. 7.

What are two main tables to maintain authorization objects

Ans: USOBT, USOBX

1. 8.

How to secure tables in SAP?

Ans: Using Authorization group (S_TABU_DIS, S_TABU_CLI) in T.Code SE54

1. 9.

What are the critical authorization objects in Security

Ans:
S_user_obj,s_user_grp, s_user_agr , s_tabu_dis, s_tabu_cli , s_develop ,s_program

1. 10. Difference between USOBT and USOBX tables

Ans: 1.USOBT-Transaction VS Authorization objects
2. USOBX- Transaction VS Authorization objects check indicators
1. 11. Use of Firefighter application

Whenever the request coming from the user for new authorization .the request goes to
firefighter owner. FF owner proved the FF ID to normal user then the user (secu admin)
will assign the authori to those users (end user)
1. 12. Where do we add the FF ids to the SAP user ids
Ans: go to Tcode
with validity

/n/virsa/vfat

>>goto fireFighter tab the give the ffID to firefighter

1. 13. How to create FF ids

Ans:
1. 14. Different types of users
Ans: 1.Diolag user 2.service user 3.system user 4.communication user 5.refrences user
1. 15. Different types of roles
Ans: 1.Single role 2.Composite role 3.Derived role
1. 16. Can a single role be used as master role?
Ans: yes
1. 17. How to create derived role
Ans: go to PFCG type the Role name stating with Z .click on create role icon .Then right
side u will find derive from here type the parent Role name
1. 18. HR Security: How to create structural authorizations in HR
Ans:
1. 19. HR Security: What are the objects for HR and what is the importance of each
HR object
Ans: P_PERNR object is used by a Person to see data related to his Personal Number
P_ORGXX HR: Master Data - Extended Check

1. 20. How to copy 100 roles from a client 800 to client 900?

Ans: Add all 100 roles as one single composite Role and Transfer the Composite role
automatically the 100 Role will transfer to the target client (Using SCC1)
1. 21. User reports that they lost the access. We check in SUIM and no change docs
found...How do you trouble shoot?
Ans: may be user buffer full or role expired

1. 22. What is the correct procedure for Mass Generation of Roles?

Ans: Using T.Code SUPC
32. What is the T.Code SQVI? What is the main usage of this SQVI?
Ans: SQVI -Quick View
33. How can we maintain Organizational values? How can we create Organizational?
Ans: PFCG_ORGFIELD_CREATE in tcode SA38
35. I want to see list of roles assigned to 10 different users. How do you do it?
Ans:
1. 1.

Goto se16 > agr_users then mention the 10 users name

2. 2.

Goto SUIM > role by complex selection > type user names

36.What do you mean by User Buffer? How it works with the user's Authorizations?
Ans: User buffer means user context it contain user related information i.e.) authorizations,
parameters, reports, earlier acceded screens .We can see the user context using T.Code
SU56
37. What is the advantage of CUA from a layman/manager point of view?
Ans: CUA used for maintain and manage the users centrally.
38. Values? What is the purpose of these Org. values?
Ans: Values: its used for restrict the user by values e.g. Sale order value (1-100) it means
user can create only 100 sales orders not more than that

40.What is the main purpose of Parameters Groups & Personalization tabs in SU01 and
Miniapps in
PFCG?
Ans: 1.Parameter tab: its used to auto fills the some of the values during the creation of
orders
2. Personalization tab is user to restrict the user in selection criteria E.g.: while selecting
pay slip it will shows only last month pay slip by default. If u select the attendances it will
shows current month by default
3. Miniapps- we can add some mini applications like calculator, calendar etc
42. How many maximum profiles we can assign to one user?
Ans:312
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

SAP SECURITY INTERVIEW QUESTIONS & ANSWERS

1.Please explain the personalization tab within a role.
Personalization is a way to save information that could be common to users, I meant to a user
role... E.g. you can create SAP queries and manage authorizations by user groups. Now this
information can be stored in the personalization tab of the role. (I supposed that it is a way for
SAP to address his ambiguity of its concept of user group and roles: is "usergroup" a grouping
of people sharing the same access or is it the role who is the grouping of people sharing the
same access)
2.Is there a table for authorizations where I can quickly see the values entered in a group
of fields?
In particular I am looking to find the field values for P_ORGIN across a number of authorization
profiles, without having to drill down on each profile and authorization.
AGR_1251 will give you some reasonable info.
3.How can I do a mass delete of the roles without deleting the new roles ?
There is a SAP delivered report that you can copy, remove the system type check and run. To
do a landscape with delete, enter the roles to be deleted in a transport, run the delete program
or manually delete and then release the transport and import them into all clients and systems.
It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS.
To used it, you need to tweak/debug & replace the code as it has a check that ensure it is
deleting SAP delivered roles only. Once you get past that little bit, it works well.
4.Someone has deleted users in our system, and I am eager to find out who. Is there a

table where this is logged?

Debug or use RSUSR100 to find the info's.
Run transaction SUIM and down its Change documents.
5.How to insert missing authorization?
su53 is the best transaction with which we can find the missing authorizations.and we can insert
those missing authorization through pfcg.
6.What is the difference between role and a profile?
Role and profile go hand in hand. Profile is bought in by a role. Role is used as a template,
where you can add T-codes, reports..Profile is one which gives the user authorization. When
you create a role, a profile is automatically created.
7.What profile versions?
Profile versions are nothing but when u modifies a profile parameter through a RZ10 and
generates a new profile is created with a different version and it is stored in the database.
8.What is the use of role templates?
User role templates are predefined activity groups in SAP consisting of transactions, reports and
web addresses.
9.What is the different between single role & composite role?
A role is a container that collects the transaction and generates the associated profile. A
composite roles is a container which can collect several different roles
10.Is it possible to change role template? How?
Yes, we can change a user role template. There are exactly three ways in which we can work
with user role templates
- we can use it as they are delivered in sap
- we can modify them as per our needs through pfcg
- we can create them from scratch.
For all the above specified we have to use pfcg transaction to maintain them.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
SAP Security Interview Questions
Q. SAP Security T-codes
A. Frequently used security T-codes
SU01 Create/ Change User SU01 Create/ Change User
PFCG Maintain Roles
SU10 Mass Changes
SU01D Display User
SUIM Reports
ST01 Trace

SU53 Authorization analysis

Q How to create users?

Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an
initial password for that user on the Logon data tab. All other data is optional. Click here for
turotial on creating sap user id
Q What is the difference between USOBX_C and USOBT_C?
The table USOBX_C defines which authorization checks are to be performed within a
transaction and which not (despite authority-check command programmed ). This table also
determines which authorization checks are maintained in the Profile Generator.
The table USOBT_C defines for each transaction and for each authorization object which
default values an authorization created from the authorization object should have in the Profile
Generator.
Q What authorization are required to create and maintain user master records?
The following authorization objects are required to create and maintain user master records:
S_USER_GRP: User Master Maintenance: Assign user groups
S_USER_PRO: User Master Maintenance: Assign authorization profile
S_USER_AUT: User Master Maintenance: Create and maintain authorizations
Q List R/3 User Types
1. Dialog users are used for individual user. Check for expired/initial passwords Possible to
change your own password. Check for multiple dialog logon
2. A Service user - Only user administrators can change the password. No check for
expired/initial passwords. Multiple logon permitted
3. System users are not capable of interaction and are used to perform certain system activities,
such as background processing, ALE, Workflow, and so on.
4. A Reference user is, like a System user, a general, non-personally related, user. Additional
authorizations can be assigned within the system using a reference user. A reference user for
additional rights can be assigned for every user in the Roles tab.
Q What is a derived role?
Derived roles refer to roles that already exist. The derived roles inherit the menu structure and
the functions included (transactions, reports, Web links, and so on) from the role referenced. A
role can only inherit menus and functions if no transaction codes have been assigned to it
before.
The higher-level role passes on its authorizations to the derived role as default values which
can be changed afterwards. Organizational level definitions are not passed on. They must be
created anew in the inheriting role. User assignments are not passed on either.
Derived roles are an elegant way of maintaining roles that do not differ in their functionality
(identical menus and identical transactions) but have different characteristics with regard to the
organizational level. Follow this link for more info

Q What is a composite role?

A composite role is a container which can collect several different roles. For reasons of clarity,
it does not make sense and is therefore not allowed to add composite roles to composite roles.
Composite roles are also called roles.
Composite roles do not contain authorization data. If you want to change the authorizations
(that are represented by a composite role), you must maintain the data for each role of the
composite role.
Creating composite roles makes sense if some of your employees need authorizations from
several roles. Instead of adding each user separately to each role required, you can set up a
composite role and assign the users to that group.
The users assigned to a composite role are automatically assigned to the corresponding
(elementary) roles during comparison. Follow the link to learn more
Q What does user compare do?
If you are also using the role to generate authorization profiles, then you should note that the
generated profile is not entered in the user master record until the user master records have
been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on a
daily.
Q. Can we convert Authorization field to Org, field
A. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE
or ZPFCG_ORGFIELD_CREATE
Use SE38 or SA38 to run the above report.
Organizational level fields should only be created before you start setting up your system. If
you create organizational level fields later, you might have to do an impact analysis. The
authentication data may have to be postprocessed in roles.
The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an
organizational level field.
In addition, all affected roles are analyzed and the authorization data is adjusted. The values of
the authorization field which is now to become the organizational level field are removed and
entered into the organizational level data of the role.
Note: Table for Org Element- USORG
Refer to Note 323817 for more detail.
Q. How many profiles can be assigned to any user master record.
A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile
assignments for users). This table contains both information on the change status of a user and
also the list of the profile names that were assigned to the user.
The field PROFS is used for saving the change flag (C = user was created, M = user was
changed), and the name of the profiles assigned to the user. The field is defined with a length of
3750 characters. Since the first two characters are intended for the change flag, 3748
characters remain for the list of the profile names per user. Because of the maximum length of
12 characters per profile name, this results in a maximum number of 312 profiles per user.

Q. Can you add a composite role to another composite role?

A. No Q. How to reset SAP* password from oracle database.
A. Logon to your database with orasid as user id and run this sql
delete from sapSID.usr02 where bname='SAP*' and mandt='XXX';
commit;
Where mandt is the client.
Now you can login to the client using sap* and password pass
Q. What is difference between role and profile.
A. A role act as container that collect transaction and generates the associated profile. The
profile generator (PFCG) in SAP System automatically generates the corresponding
authorization profile. Developer used to perform this step manually before PFCG was
introduced bySAP. Any maintenance of the generated profile should be done using PFCG.
Q. What is user buffer?
A. When a user logs on to the SAP R/3 System, a user buffer is built containing all
authorizations for that user. Each user has their own individual user buffer. For example, if user
Smith logs on to the system, his user buffer contains all authorizations of role
USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.
A user would fail an authorization check if:
The authorization object does not exist in the user buffer
The values checked by the application are not assigned to the authorization object in the user
buffer
The user buffer contains too many entries and has overflowed. The number of entries in the
user buffer can be controlled using the system profile parameter auth/number_in_userbuffer.
Q. How to find out all roles with T-code SU01?
A. You can use SUIM > Roles by complex criteria or RSUSR070 to find out this.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.
You can also get this information directly from table, if you have access to SE16 or SE16N.
Execute SE16N
Table AGR_1251
Object S_TCODE
VALUE (low) SU01
Q. How to find out all the users who got SU01 ?
A. You can use SUIM >User by complex criteria or (RSUSR002) to find this out.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.

Q. How to find out all the roles for one composite role or a selection of composite roles?
A. Execute SE16N
Table AGR_AGRS
Composite roles You can put multiple composite roles using the more button
Q. How to find out all the derived roles for one or more Master (Parent) roles?
A. Execute SE16N
Table AGR_DEFINE
Use either agr_name field or Parent_agr field.
Q. How can I check all the Organization value for any role?
A. Execute SE16N
Table AGR_1252
Role Type in the role here and hit execute.
You can always download all the information to spreadsheet also using .
Q. How do I restrict access to files through AL11?
A. First create an alias. Go to t-code AL11 > configure > create alias. Let say we are trying to
restrict alias DIR_TEMP which is /tmp. Open PFCG and assign t-code AL11, and change the
authorization for S_DATASET as mentioned below
Activity 33
Physical file name /tmp/*
Program Name with Search Help *
Q. How can I add one role to many users?
A. SU10. If you have less than 16 users then you can paste the userids.
If you have more than 16 users Click on Authorization data and click on next to users and
upload from clipboard .
Hit the change button and go to the role tab and add the roles to be assigned and hit save.
Q. What are the Best practices for locking expired users?
A. Lock the user. Remove all the roles and profiles assigned to the user. Move them to TERM
User group.
Q. How can be the password rules enforced ?
A. Password rules can be enforced using profile parameter. Follow the link to learn more about
the profile parameter.
Q. How to remove duplicate roles with different start and end date from user master?
A. You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 365841 for more
info.
Q. How come the users have authorization in PFCG, but user still complains with no
authorization?

A. Make sure the user master is compared. May be the there is a user buffer overflow
Also check the profile- Follow the instruction below.
SUIM > User by complex criteria.
Put the userid of user who is having issue.
Execute
Double click on the user id and expand the tree. Select the profile in question and see if the
authorization is correct or not. If not do the role reorg in PFCG and see if that helps.
Q. How can I have a display all roles.
A. Copy sap_all and open the role and change the activity to 03 and 08
Q. How can I find out all actvt in sap?
A. All possible activities (ACTVT) are stored in table TACT (transaction SM30), and also the
valid activities for each authorization object can be found in table TACTZ (transaction SE16).

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Add T-CODE IN Role MENU Vs Add T-CODE in S_TCODE OBJECT

What is diffrence between add T-CODE IN ROLE MENU (PFCG) and add T-CODE in
S_TCODE OBJECT IN TCD field?
Roles are basically graphical interface of an end-users. If you add some role in PFCG Menu
then end-user will show a link in end
Even end-users dont know which T-CODE is calling for clicking a link in his/ her screens. and
link will appear only when ROLE will assigned to user.
But when you add a T-CODE in S_TCODE in TCD fields then user is able to run the query in
backend (sap logon pad), not from the end-user screen cause no LINK will come for that.
So, when you enter a T-CODE in PFCG screen it will automatically added to object
S_TCODE, but opposite is not true.
Suppose you have a profile SAP_ALL, you can do anything in backend (using SAP LOGON
PAD). but when you assigned this to a end-user, he/she should not get any link to their screens
(its a profile not Role).
Like, we are in Security Module, we have access for User and Role administration. but a person
Like Sales Supervisor, he/she dont know even what are the background behind that, he/she
knows only if he clicks some link he can perform some job.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

SAP Security Interview Questions

Q. How many profiles can be assigned to any user master record?

Maximum number of profiles that can be assigned to any user master record is 312.
Table USR04 contains the profiles assigned to users. The field PROFS in USR04 table
is used for saving the change flag and the name of the profiles assigned to the user.
The change flags are C which means User was created and M which means
User was changed. The field PROFS is defined with a length of 3750 characters.
Since the first two characters are intended for the change flag, 3748 characters
remain for the list of the profile names per user. Because of the maximum length of
12 characters per profile name, this results in a maximum number of 312 profiles
per user.
Q. Can a composite role be assigned to another composite role?
No. A composite role cannot be assigned to another composite role. Single roles are
assigned to composite roles.
Q. What does the PFCG_TIME_DEPENDENCY clean up?
The PFCG_TIME_DEPENDENCY background report cleans up the profiles (that is, it
does not clean up the roles in the system). Alternatively, transaction code PFUD
may also be used for this purpose.
Q. How to prevent custom objects from getting added to SAP_ALL profile?
Go to table PRGN_CUST and set the following parameter: ADD_ALL_CUST_OBJECTS
with value N.
Regenerate the SAP_ALL profile with report RSUSR406 to have the customer object
to be removed from SAP_ALL. See SAP Note 410424 for more info.
Q. How to find out all actvt in sap?
All possible activities (ACTVT) are stored in table TACT , and the valid activities for
each authorization object can be found in table TACTZ.
Q. How to remove duplicate roles with different start and end date from
user master?
Duplicate roles assigned to a user can be removed using PRGN_COMPRESS_TIMES.

Q. What important authorization objects are required to create and

maintain user master records?
Following are some important authorization objects which are required to create
and maintain user master records:

 S_USER_GRP: User Master Maintenance: Assign user groups

S_USER_PRO: User Master Maintenance: Assign authorization profile
S_USER_AUT: User Master Maintenance: Create and maintain authorizations
Q. Which table is used to store illegal passwords?
Table USR40 is used to store illegal passwords. It can be used to store patterns of
words which cannot be used as passwords.

Q. Explain the concept of Status Text for Authorizations Standard,

Changed, Maintained and Manual.

Standard It means that all values in authorization field of an authorization

instance is unchanged from the SAP default value (i.e. the values which are
getting pulled from SU24)

Maintained It means that at least one of the field values in an

authorization instance was blank when it was pulled from SU24 (i.e. SAP
default value) and that blank field has been updated with some value. Other
fields already having some value have not been touched.

Changed It means that the proposed value in at least one of the fields in
an authorization instance has been changed.

Manual It means that at least one authorization field has been manually
added, i.e. it was not proposed by profile generator.

Q. What is the difference between Role and Profile?

A Role is like a container which contains authorization objects, transaction codes
etc. A profile contains authorizations. When a role is generated using PFCG, a
profile is generated which contains authorizations (instances of authorization
objects).
Q. What is PFCG_TIME_DEPENDENCY ?
PFCG_TIME_DEPENDENCY is a report which is used for user master comparison.
It should be a practice to do user master comparison after every role change and
profile generation so that the users master record gets updated with the correct
authorization. This report also cleans up the expired profiles from user-master
record. Role name still remains in the SU01 tab of the user. Transaction code PFUD

can also be used to directly execute this report.

What is the difference between authorization user group and logon group?
Authorization user group is used for user management purpose. Each user group
is managed by certain security administrators. Authorization object S_USER_GRP
determines users of which user group can be administered by a certain user admin.
Those users who are not assigned to any user group can be administered by all the
security user admins.

Logon groups are generally created by SAP Basis Administrators and used for
logon load balancing. These are logical groups of users. These users can be
assigned to one or more SAP instances. When a Logon group is assigned to an SAP
instance, all users belonging to that logon group would by default logon to that
particular instance. Hence logon group helps in load balancing.
What steps are checked by the system when an interactive user executes
a transaction code?
Various steps are checked when a user executes a transaction code:
(1) First it is checked whether the transaction is a valid transaction code. This is
checked in TSTC table. If the tcode does not exists, the system gives the message
that the transaction does not exist.
(2) If the tcode is a valid tcode, then the system checks whether the tcode is locked
or unlocked. Field CINFO in TSTC is used to determine whether the transaction is
locked or unlocked.
(3) The system then checks if the user has necessary tcode value maintained in
authorization object S_TCODE in his/her user buffer. If the authorization object
S_TCODE contains the required tcode, then the system checks whether any
additional authorization check is assigned to the tcode via SE93. This value can be
found on the initial screen of SE93 for that tcode or in TSTCA table.
(4) Further authorization check takes place based on the values present in the
source code under Authority-check statement and the activity performed by the
user.
How do we know who made changes to Table data and when?
If checkbox for table Log Changes is enabled, table DBTABLOG keeps all the log
data for the related table.

What is a composite role?

A composite role is like a container which contains several single roles. They do not
contain authorization data and the authorization needs to be maintained in each
role of the composite role. A composite role cannot be added to a composite role.
The users assigned to a composite role are automatically assigned the
corresponding single roles.

Q What is the difference between USOBX_C and USOBT_C?

USOBX_C and USOBT_C are tables which are used for SU24 transaction code.
The table USOBX_C defines the status of authorization checks for authorization
objects, i.e. whether the check indicator is set to yes or no. It also defines the
proposal status, i.e. whether the authorization check values are being maintained in
SU24 or not.
The table USOBT_C defines the values which are maintained for check-maintained
authorization objects.
Q. What does the different color light denote in profile generator?
There are three colors (like traffic lights) in profile generator:
Red It means that some organizational value has not been maintained in org field
in profile generator.
Yellow It means that there are some or all fields in certain authorization
instances which are blank (not maintained)
Green It means that all the authorization fields are maintained (values are
assigned).
Q. How can we convert Authorization Field to Org Field?
The report PFCG_ORGFIELD_CREATE is used for converting an Authorization
Field to Org Level Field. It can be executed using SA38/SE38 tcode.
There is a bit of caution involved here. Make sure that whatever change related to
this conversion is made is done in the initial stage of security role design/system
setup. In case this task is performed at a later stage, there is a risk that this will
impact lots of existing roles. All those roles would require analysis and authorization
data will have to be adjusted.
NOTE : Authorization fields TCD (Tcode) and ACTVT (Activity) cannot be

converted to org level fields.

Q. How do we find all activities in SAP?

All Activities in SAP are stored in table TACT. All valid activities are stored in table
TACTZ. The tables can be accessed via SE16 tcode.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

SU25 Upgrade Tool for Profile Generator

Why SU25 is required?

After upgrading SAP with the new release, you need to make adjustment to the all the roles and
transaction codes.SU25 is the transaction code for upgrading profile generator.

This has 6 different steps and the execution of these steps depends on whether you were
already using profile generator in the last release.
This transaction has 6 steps. This transaction is used to fill the customer tables of the
Profile Generator the first time the Profile Generator is used, or update the customer tables after
an upgrade. The customers tables of the Profile Generator are used to add a copy of the SAP
default values for the check indicators and field values. These check indicators and field values
are maintained in transaction SU24. If you have made changes to check indicators, you can
compare these with the SAP default values and adjust your check indicators as needed.
Step1: If you have not yet used the Profile Generator or you want to add all SAP default values
again, use the initial fill procedure for the customer tables.
If you have used the Profile Generator in an earlier Release and want to compare the data with
the new SAP defaults after an upgrade, use steps 2a to 2d. Execute the steps in the order
specified here.

Step 2a: is used to prepare the comparison and must be executed first.
Step 2b - If you have made changes to check indicators or field values in transaction SU24, you
can compare these with the new SAP default values. The values delivered by SAP are
displayed next to the values you have chosen so that you can adjust them if necessary. If you
double-click on the line, you can assign check indicators and field values. You maintain these as
described in the documentation for transaction SU24.

Note on the list of transactions to be checked To the right of the list you can see the status
which shows
whether or not a transaction has already been checked. At first the status is set to to be
checked.
If you choose the transaction in the change mode and then choose save, the status is
automatically set to checked.
By choosing the relevant menu option in the list of transactions you can manually set the status
to checked without changing check indicators or field values, or even reset this status to to be
checked.
If you want to use the SAP default values for all the transactions that you have not yet checked
manually, you can choose the menu option to copy the remaining SAP default values.
Step 2c: You can determine which roles are affected by changes to authorization data. The
corresponding authorization profiles need to be edited and regenerated. The affected roles are
assigned the status profile comparison required.
Alternatively you can dispense with editing the roles and manually assign the users the profile
SAP_NEW (make sure the profile SAP_NEW only contains the subprofiles corresponding to
your release upgrade. This profile contains authorizations for all new checks in existing
transactions). The roles are assigned the status profile comparison required and can be
modified at the next required change (for example, when the role menu is changed). This
procedure is useful if a large number of roles are used as it allows you to modify each role as
you have time.

Step 2d: Transactions in the R/3 System are occasionally replaced by one or more other
transactions. This step is used to create a list of all roles that contain transactions replaced by
one or more other transactions.
The list includes the old and new transaction codes. You can replace the transactions in the
roles as needed. Double-click the list to go to the role.
Step 3: This step transports the changes made in steps 1, 2a, and 2b.
Tailoring the Authorization Checks
This area is used to make changes to the authorization checks.
Changes to the check indicators are made in step 4. You can also go to step 4 by calling
transaction SU24.
-You can then change an authorization check within a transaction.
-When a profile to grant the user authorization to execute a transaction is generated, the
authorizations are only added to the Profile Generator when the check indicator is set to
Check/Maintain.
-If the check indicator is set to do not check, the system does not check the authorization object

of the relevant transaction.

-You can also edit authorization templates that can be added to the authorizations for a role in
the Profile Generator. These are used to combine general authorizations that many users need.
SAP delivers a number of templates that you can add directly to the role, or copy and then
create your own templates, which you can also add to roles.
In step 5 you can deactivate authorization objects system wide.
In step 6 you can create roles from authorization profiles that you generated manually. You then
need to tailor and check these roles.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Difference between SE16 and SE16N

SE16:
** SE16 is a data browse and it is used to view the contents of the table and we cannot change or
append new fields to the existing structure of the table as we cannot view the structure level
display using the SE16 .

SE16N:
** The transaction code SE16N (general table display) is an improved version of the old data
browser (SE16). It has been around for some time, but is not widely known amongst consultants
and end users of SAP. It looks a bit different to the old data browser functionality (SE16).

** Once you have entered your table name, type "&SAP_EDIT" without the quotation marks into
the transaction code. This enables editing functionality on SE16N and allows you to make table
changes. This allows you to access both configuration and data tables which may be otherwise
locked in a production environment.

** Whilst this may appear to be a short cut and allow you to access a back door which is
normally shut, this hidden feature should be used with caution in any SAP client - especially a
live or production system.

New Features of SE16N:

** The new transaction has a number of distinct advantages over SE16.

** You no longer have a maximum of 40 fields to select in the output.
** There are fewer steps involved in executing a numberof functions, whether it be outputting
the results, maintaining the values in a table etc.
** Exporting the data into Excel is far easier and quicker
** ALV functionality is available as standard
** The user is not restricted by having a maximum width of 1023 saved as a default in the user
settings.

Limitations of SE16N:

**You can only output one table at a time. If you wish to output more than one table you can use
the available reporting tools or the QuickViewer (transaction code SQVI) functionality within
SAP.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
How to Create and Use the Authorization Objects in ABAP
AuthorizationObjectsareusedtomanipulatethecurrentusersprivilegesforspecificdataselectionand
activitiesfromwithinaprogram.
Stepstocreateauthorizationfield
1.GototransactioncodeSU20
2.Clickthecreatenewbuttonontheapplicationtoolbar.
3.EnterZTCODEintheFieldNameandTCODEintheDataElement,thenhitEnter.
4.Clickthesavebuttononthesystemtoolbar.
Nextstepistocreatetheauthorizationclass(see#1infigure1)andauthorizationobject(see#2infigure
1).
Stepstocreateauthorizationclass

1.GototransactioncodeSU21
2.ClickontheCreatebuttonsdropdowniconandselectObjectClass.
3.EnterZTRNontheObjectClassfield.
4.Giveitadescriptionandsaveit.
Stepstocreateauthorizationobject
1.AgaininSU21,inthelistofauthorizationclass(foldericon),clicktheonethatwevecreated(ZTRN).
2.ClickontheCreatebuttodropdown,thistimeselectingAuthorizationObject.
3.EnterZ_TCODEontheObjectfieldandgiveitadescription.
4.Ontheauthorizationfieldssection,enterACTVTandZTCODE.ACTVTisusedtosetandlimitthe
activityoftheuser,whiletheZTCODEistheauthorizationfieldthatwevecreatedearlierwhichis
responsibleforholdingalistoftcodes.
5.OntheFurtherAuthorizationObjectSettings,clickonPermittedactivitiesbutton.Herewewill
selectthespecificactivitiesthatwewanttobeavailableforourauthorizationobject.
6.Asanexample,wewillselect01(Create),02(Change),and03(Display).
7.SaveandExit.
Nowweredonecreatingourownauthorizationobject,letusnowuseandassignittoauser.
Stepstocreatearole(seefigure2)
1.GototransactioncodePFCG.
2.EnterZAUTHTESTonRolefieldandclicktheSingleRolebutton.
3.Nowgiveitadescription,clickthesavebuttonandclicktheAuthorizationtab.
4.ClicktheChangeAuthorizationDatabuttoninsidetheauthorizationtab.
5.ThenclicktheManuallybuttonontheapplicationtoolbarandtypeinthenameoftheauthorization
objectthatwevecreatedearlier(Z_TCODE)andpressenter.
6.Expandallthenodes,doubleclickontheinputfieldoftheActivityandselectactivity01and02.
7.EnterthetcodeofourownabapprograminZTCODEfield,inourexampleIusedZCOMM.
8.AndalsodontforgettoaddtheS_TCODEauthorizationobjectandenterZCOMMonitsfield.
9.NowClickontheGeneratebuttonintheapplicationtoolbarandpressenteronthepopupscreen.
10.pressthebackbuttonandassignaspecificuserontheusertabandclickUserComparisonbutton.
11.Nowcreateanotherrolebyrepeatingsteps1to9butthistimeselectactivity03onstep6.
12.Thenassignthis2ndroletoanotheruser.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
critical authorization objects in SAP

Lets have a look at some of the critical authorization objects in SAP. From
Audit perspective, it is pertinent that special care must be taken while
assigning full access * to any field value.
S_PROGRAM All critical programs and reports should be linked with proper authorization
groups. Appropriate action should be maintained for this object.

S_TABU_DIS Caution should be taken while maintaining change access for this
object.

S_TABU_CLI Access to this object should be strictly restricted.

S_TCODE Make sure that this authorization object does not give access * access or
access to big ranges using wildcards on the TCD field.

S_DEBUG Should be assigned with caution. Make sure not to give the change debug
access in production.

S_RZL_ADM For R/3 System administration using the CCMS. This should only be
required by Basis.

S_ADMI_FCD For checking access to some Basis functions, like spool administration
and monitoring. Normally for Basis Team only.

S_BTCH_ADM For processing background jobs. Only needed by Basis or Background

admin.

S_BDC_MONI For batch input management and monitoring Can be assigned to

Functional Team when they upload data using LSMW

S_CTS_ADMI For administration functions in the Change and Transport System. Only
to Basis.

S_LOG_COM For executing external operating system commands Only to Basis.

S_TRANSPRT For transport organizer Only to Basis.

S_DATASET For accessing files from ABAP/4 programs. ABAP Program name and
File Path should be maintained with caution.

S_USER_* Should be maintained very carefully. Make sure to give display access
(activity 03) only. For Security Team.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

SAP Table Authorization

This post deals with detailed discussion on the concept of sap table authorization.
Tables store data. The data can be client specific data or cross client data.
It is necessary to know the meaning of client for understand the meaning of client specific and
cross client data.
We have already discussed about the concept of client in one of our posts. Repeating the
definition of client again - A client is an independent accountable entity within R/3 system. It
can represent a company or a business unit. It has its own master data and transaction data and
user master records (client specific data).
A client is always represented by a three digit number. SAP R/3 comes in built with three
standard clients , i.e. 000, 001 and 066. Since a client is always a three digit number, an SAP
System can have a maximum of 1000 clients (from 000 to 999). Out of these, a maximum of 997
clients can be customer specific clients and 3 (i.e. 000, 001 and 066) are SAP standard clients.
Data is stored in SAP database tables. This data is grouped based on clients. Client specific data,
as the name suggests, is the data which is client dependent. Data specific to a particular client
cannot be seen from other clients. Tables which contain client specific data have a field called
client (MANDT). This MANDT field contain the client number. If the same table is viewed from
other client, the MANDT will contain the three digit client number of that particular client and
the data for that client.
Cross client data is that data which can be accessed from all clients. This is also called client
independent data, which means that if a data in a table can be accessed from a client, say client
100, then the same data can be accessed from any other client (say client 200) also.

Now when we have discussed tables and data, the question arises as to how to access this data?
What authorization is required for accessing any table data?
Tcode SE16 (Data browser) can be used for accessing table. But will just having access to
transaction code SE16 or SM30 (Call View Maintenance) gives the authorization to access any
table?

There are some authorization objects for securing tables. In this post we are going to discuss
about the most important of all those authorization objects authorization object
S_TABU_DIS. There are a few more authorization objects for tables which we would be
discussing in our next post.
But before that lets understand a very important technical concept called table
authorization group which plays the most important part for authorization to any table.
Table Authorization group allows us to secure access to tables in SAP. Authorization group

(BRGRU) is represented by the authorization field DICBERCLS and is a part of authorization

object S_TABU_DIS.
For a table to be secured, it should be linked to an authorization group. An authorization group
can be created via transaction code SE54. The maximum length of a table authorization group is
4 characters.
The initial screen of SE54 is as below:

A table can be linked to an existing authorization group or a new authorization group can be
created. Both creation of a new authorization group and linking of the table can be done via
tcode SE54.
One table can be linked (assigned) to only one authorization group. But one authorization group
can be linked to more than one tables.
So, when a user gets access to any authorization group, he can access all those tables that are
linked to that authorization group (assuming there is no dependency on any other authorization
object for any table/tables).
Now let us discuss about the authorization object for securing tables. In this post we are going to
discuss about authorization object S_TABU_DIS.
Authorization Object S_TABU_DIS has two authorization fields :

Authorization Group (DICBERCLS)

Activity (ACTVT)

Permitted values for ACTVT (activity) are 02 (change) and 03 (display).

Let us take an example. Suppose there is a table authorization group Z123 and suppose 5 tables
are linked to Z123.
Let us assume that the user has following access in his user master record:
Authorization object S_TABU_DIS

ACTVT (Activity) 03

DICBERCLS (Authorization Group) Z123

From the above access user should be able to display the 5 tables which are linked to Z123.
Here it is assumed that the user has access to table browsing tcodes like SE16 or SM30 or any
parameter tcode for accessing the table. Also, there should not be additional condition like
tables being cross client or restriction based on table name etc. All these restrictions are handled
via other authorization objects which we would be discussing in our next post.
A few questions that need to be addressed:
How do we find out what all tables are linked to a particular authorization group?
Table TDDAT can be used for that purpose. It provides the list of tables which are linked to an
authorization group. It can also be used for finding the authorization group for a particular
table.
Where do we find list of all table authorization groups?
Table TBRG contains the table authorization groups.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Determining Free Space of Each Table before Archiving

How to get the information about the how much space will get free from each table which is
related to an archiving object before performing archiving on that particular object? Are
there any transactions for the same or some transaction which can be related to these? For
e.g. FI_DOCUMNT is related to lots of table, before archiving this object, how to know that the
space will be free from all the tables individually which are affected by this object?
Usually the (minimum) resident time (how long data has to be stored) is fixed by law or in long
business discussions - so everything older should be archived, nothing newer is allowed to be
archived. Based on this, I doubt that anyone really needed a detailed space analysis.
Because of a lot of dependencies between the different parts of an archiving object, it's not so
easy to fetch all data to be archived -> there is a test mode, where objects are only gathered and
analyzed.
From these test runs in transaction SARA you can see the number of archivable entries per
object (-> table), with the line size you can calculate the amount, but already the number (1458

of 57899 documents) will be helpful. In this example roughly 2.5% could be deleted -> you will
win 2.5% of current used space -> or just the space for additional 1458 documents.
But it can be easier! If all documents are closed correctly, then you can estimate by total volume
of documents per year and resident time: when you have 1 million docs per year, you have to
store for 2 years, everything above 2.2 Mio can be deleted - the 0.2 for some open stuff, which
has to be closed before deletion.
Situation: I am preparing an approach document to show it to management.
Problem: I want to show to management total space likely to get free if we start archiving
process. Bifurcated amongst different archiving objects and amongst years so that we can
show how much one particular business object is taking space and I can show which all
archiving objects we should start with. If I don't want to run the archiving object in PRD in
test mode. I want to know is there any other alternative for finding the same except
consolidation of different table size a particular archiving object is hitting.
There is no easy tool to get this numbers. But on the other hand, you don't need exact numbers,
estimations will do.
It's a good idea to start with the biggest objects: take DB02 , make a detailed analysis where you
select the biggest tables -> corresponding archive objects should be your main focus (for the
beginning).
Count for the biggest tables in each objects the entries per year (or month, whatever periods you
are interested in). Most tables have creation date to do so, otherwise go for number range. For
some numbers you could search the creation date, the rest is estimation again. Then you will
have an idea, which volume was created in which time frame.
Still you need some test archive runs (in PRD or an (old) copy, at least for an example amount of
data): you need to know, which % of the documents can technically be archived, how much will
stay open because of missing closing. That's critical information (maybe 90% will stay in system)
and can only be analyzed by SARA test runs - if you identify the missing object status, you can
go on selecting this directly, but in the beginning you need the archive run.
With the volume / time frame and the percentage, which can be deleted you should be able to
give estimations based on current total object size. Make clear, that you talk about estimations:
every single object will be checked for having correct status - before this isn't done (in a test
run), no one can tell exact numbers.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

No System name and transaction code in SM04

If you have more than one application server, use AL08 instead of SM04.
or
It is because they are at the logon screen which has established a connection.
You will notice that the transaction code shown when there is no user name is
SESSION_MANAGER.

This shows you which workstations out there have the login screen up but have not
yet entered a user name and password.
The transaction column shows the Last executed transaction code.
Sometimes your users will have multiple sessions open. If they do, to the system, it
is the same as multiple logins as it relates to the resources used etc.
So the user name will show up more than once in AL08.
Under the application server they are logged into, each instance of that user name
on that application server represents a session open.
For instance if you run AL08, you will have your name show up at least twice on the
application server you are logged into.
One will show AL08 and the other will not have a transaction next to it.
Then you will notice your user name showing up on all other application servers
with no transaction. This is because you are using AL08.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

See from which network IP address and host name a user has logged on

To see the network IP address from which a user has logged on,
perform the following steps:
Call transaction OS01,
click "Presentation Server" button, "Change View" button.
If you are using Citrix, you will not be able to view the user individual IP address as
it will be the same Citrix IP address.
To check the speed and quality of the user's network connection,
select the desired presentation server and click "10 X Ping" button.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Difference Between SAP_ALL and SAP_NEW
What is the difference between SAP_ALL and SAP_NEW
Definition of SAP_NEW:SAP_NEW is a SAP standard Profile which is usually assigned to system users temporarily
during an upgrade to ensure that the activities and operations of SAP users is not hindered,
during the Upgrade. It contains all the necessary objects and transactions for the users to
continue their work during the upgrade. It should be withdrawn once all upgrade activities is
completed, and replaced with the now modified Roles as it has extensive authorizations than
required.

Definition of SAP_ALL:SAP_ALL is a SAP standard profile, which is used on need basis, to resolve particular issues
which may arise during the usage of SAP. It is used by Administrators/Developers only and is
applied on a need to use basis, then withdrawn. It contains all SAP system objects and
Transactions. SAP_ALL is very critical and only SAP* contains SAP_ALL attached to it in the
production system. No other dialog users have SAP_ALL attached to them.
SAP_NEW is used in the Production environment during a version upgrade whereas SAP_ALL
shouldn't be or not allowed be used in Production (for audit purposes obviously), except where
necessary, in a controlled manner with all proper approvals from the customer.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++