---

Transport Tasks

 

Configuring TMS - Transport Management System - for the First Time

 

Note:  if you already have a TMS configured, do not use this section to add a new instance to the existing TMS configuration.  You could severely damage any pre-existing transports, making them untransportable.  Instead, use the following section Adding New Instance to TMS Setup.

 

1.       Log on to client 000 of the SAP instance to serve as the Domain Controller.

2.       Go to transaction SE06.

3.       Click on the Perform Post Installation Actions button.

4.       Go to transaction STMS.

5.       You should see a popup box with the title TMS: Configure Transport
Domain. If the popup doesn't say that, press F6 to change to the
correct popup box.

6.       Fill in the TMS: Configure Transport Domain popup with the
Description, Name of DOMAIN_<SID>, and the description of the
Transport Domain. Then click Save.

7.       On the Transport Management System screen (if you aren’t there, back out until you are), assuming that this is the first SAP instance and there are no other
installed SAP instances in your landscape yet, and assuming that you
want your transport requests to be transportable and not local only,
click on Overview → Systems.

8.       On the System Overview – Domain Domain_<SID> screen, click SAP System → Create → External System. Fill in QAS if you are going to have a three system configuration or PRD if you are going to have a two system configuration, or make up a <SID> if you are never really going to have another SAP system. Fill in the rest of the information including the Path which is assumed to be
\\<current server>:\usr\sap\trans for NT or /usr/sap/trans for UNIX. Click Environment → Transport Routes.

9.       On the Display Transport Routes screen, click the User Settings button, turn “on” the Hiergraphical List Editor, and click the √ Continue button.  Back out of the screen and then go back in – you should see the list in a text mode which makes it easier to handle.

10.   On the Display Transport Routes screen, click the Display<>Change button to toggle into Change Mode. 

11.   On the Change Transport Routes screen, click Configuration → Standard Configuration → Development and Production System.

12.   Fill in the Development and Production System popup, using your current SAP system SID as the Development system and the SAP instance you created in step #8 as the Production system. Click the √ mark to Continue.

13.   Back on the Change Transport Routes screen, click the Save icon and confirm all the popup questions.

14.   On the Change Transport Routes screen, back out until you can once more see the Transport Management System screen.  Click Overview → Systems.

15.   On the Display TMS Configuration: System XXX screen, double-click the TMS Domain domain controller SAP instance.

16.   On the Display TMS Configuration: System XXX screen, click the Display<>Change button to toggle into Change Mode. Click the Communication tab and make sure that the Transport Group Name is correct.  It should contain of the Domain Controller in the format of DOMAIN_<SID> where <SID> is the System ID of the SAP Domain controller.  Use the dropdown to find the correct entry it the field is blank.  Click the Transport Tool tab.  Verify that the information on the tab is correct and click the Insert Row button.  Add a Parameter of CTC and a Value of 1.  Click the Save button.

17.   Do step #16 for every system in your TMS Domain, making sure to change all Transport Group Names are the same and the CTC row is added to each with a value of 1.

18.   Save your way back the the main STMS screen.

19.   You may now leave STMS.

Adding a New SAP Instance to an Existing TMS Domain Controller

 

1.        Log on to client 000 in the SAP instance you want to add to the existing TMS

 Domain.

2.        Go to transaction SE06.

3.        Click on the Perform Post Installation Actions button.

4.        Go to transaction STMS.

5.        You should see a popup box with the title TMS: Configure Transport
 Domain. Press F6 until you see a TMS: Include System in
 Transport Domain popup.

6.        Fill in the TMS: Include System in Transport Domain popup with the
 Description, Target Host, and System number of the TMS Domain
 Controller then click Save.

7.        You should see a message that says SAP System waiting to be
 included in the Transport Domain.

8.        Log on to client 000 of the Transport Domain Controller and go to transaction

 STMS, keeping your original session in the other SAP instance open.

9.        On the Transport Management System screen, click Overview → Systems.

 Highlight the System you just added and then click SAP System → Approve.

 Then confirm all the messages.

10.    Back on the Transport Management System screen, click Environment →

    Transport Routes.

11.  On the Display Transport Routes screen, click the Display<>Change button

    to toggle into Change Mode.  Click on Edit → Transport Route → Create.

11.    On the Create Transport Route popup, use the Consolidation boxes to enter

    the SID of the transport domain, create a Z* transport layer, and the SID

    of the system you are adding.  Click Save and confirm. Back out to the main

    Transport Management Screen.

12.    Back on the Transport Management System screen, click Overview → Systems.

Double-click on the new system, and click on the Communications tab. Make

sure that the Transport Group name is the name of the original transport

domain. If not, change it. Click the Transport Tool tab.  Verify that the

information on the tab is correct and click the Insert Row button.  Add a

Parameter of CTC and a Value of 1.  Click the Save button.

13.    You can switch back to the new instance, and confirm that the SAP System

    waiting to be included in the Transport Domain has disappeard.

14. You may now log out of both SAP instances.

Make a Local Transport into a Transportable Transport

 

Sometimes, mistakes just happen.  For this example, we will use a transport

SM1K00047 as the erroneous change request.  Make sure to release SM1K00047 before

beginning this procedure.

 

1.    Log on to the client who is the owner of the local transports that needs fixed.    

2.    Go to SE03.

3.    On the Transport Organizer List screen, click on Merge Object Lists which is

   in the Requests/Tasks section.

      3. On the Merge Objects List screen, put SM1K00046 in the first Request/Task

   field. Make sure that the Released check box is "on" in the Request Status

   section and click the Execute icon.

4. On the Merge Objects List screen, click on the Merge icon.
5. On the Enter Transport Request popup, click the Create Request icon.
6. On the Select Request Type popup, click "on" radio buttion Workbench Request.
7. On the Create Request popup, fill in the necessary information and make sure

   that the fill in the Target field so that the transport request is NOT local.
   Click the Save, OK, √ icon, etc. until everything is done. You will

   get a new transport request number, in our case SM1K00050.  This new request

   can be released using one of the transport organizer Transactions like SE10,

   etc. Once it is released, you can go to /usr/sap/trans on the OS level and in

   directory cofiles copy K00050.SM1 to K00046.SM1, and in directory data copy

   R00050.SM1 to R00046.SM1.

8. You may now leave SE03.

 

Once you have control of your session again, the transports are done.  Verify their return code in the Import Queue list.  It shoud have been updated automatically.

 

Transporting Change Requests

 

To manually transport change requests from DEV/QAS to PRD:

 

1.       Make sure the change request(s) has been released via Se10 or one of the other Transport Organizer Transactions.

2.       Go to transaction STMS and click Overview → Imports.  Double-click the PRD queue.

3.       Click the refresh button to make sure you have the most current view of the PRD queue.  Make sure the change request(s) you want to transport shows in the queue.

4.       Using the F9 button, highlight all the transactions you want to manually transport.

5.       Click on Extras → Activate Inactive Requests.  Confirm the popup.  This bypasses the STMS_QA process.

6.       Leave the change requests highlighted.  Click Request → Import.  On the popup, make sure that the target is client 300.  Make sure that Synchronous radio button is "on" in the Execution tab.  Make sure that the first three options are checked "on" in the Options tab.  When you are done, click on the green √ and confirm the next popup.

 

Once you have control of your session again, the transports are done.  Verify their return code in the Import Queue list.  It shoud have been updated automatically.

Adding a Change Request to a Transport Queue

 

1.       Make sure the change request(s) has been released via Se10 or one of the other Transport Organizer Transactions.

2.       Go to transaction STMS and click Overview → Imports.  Double-click the PRD queue.

3.       Click on Extras → Other Requests → Add.  Fill in the Number of the Transport Request to be added to the queue and then press Enter. 

4.       Confirm the Add Transport Request popup.  The transport request should now appear at the bottom of the queue list.

Viewing the Transport Queue History

 

1.       Go to transaction STMS and click Overview → Imports.  Double-click the queue for which you want to view the history.

2.       Click on the Import History button or press Ctrl+F7.  The resulting list can be sorted and filtered to produce a more exacting report if needed.

 

Re-Transport Several Change Requests at Once

 

1.        Go to transaction STMS and click Overview → Imports.  Highlight the queue into which the transport(s) to be moved again were originally  transported – the “FROM” queue - and click the Import History button or press Ctrl+F7. 

2.        If your SAP instance is older, you may have a very long Import History list in the next screen.  Use some of the available filters and sort options to create a more controllable list of transports.  Use the F9 to select and/or unselect as many as you need to transport.

3.        Once all choices have been made, click Request → Forward → System.  Fill in the “TO” system and click on the Execute green √ mark.

4.        Now you can go to the “TO” queue and refresh the list.  Your imports should all be there.

Transport Tool System Confirmation

 

1.       Go to transaction STMS and click Overview → Imports. 

2.       On the Import Overview screen, click Import Queue → Check → Transport Tool.  You may get a message asking if you want to check the the transport tool for all systems.  If only want to check a limited subset of the SAP instances, use F9 to select and/or deselect those systems before you click Transport Tool. 

3.       On the TMS: Check Transport Tool screen, a list of all selected SAP instances to be checked will appear. 

If you see any thing but red green Oks, expand all the lines with the non-OK marks and look for more information.  Correct these problems and then run this report again until it comes back clean.

 

Use Target Groups to Transport to Mulitple Clients in Two Different Instances

 

1.        Log on to client 000 of your TMS Domain Controller SAP Instance.

2.        Go to transaction STMS.

3.        On the Transport System Management screen, click Overview -> Transport

    Routes.

1.     On the Display Transport Routes screen, click the Display<>Change button to

    toggle into Change mode.  Click on the Target Groups line and click the

    Create button.  

2.     In the Create Transport Group popup, fill in the Target Group as /XXXCLNTS/,

    give a Short Description and click the Client Assignment button.  Be aware

    that the Target Group name must start and end with a “/”.

3.     Enter each Target system and Target client you need. For our example, we will

    DEV 100, QAS 200, and QAS 210.  Click the green check mark to Transfer. You

    now have a target group. Now you must create a Consolidation Layer.

4.     Back on the Change Transport Routes screen, click on Transport Routes and

    click Create.

5.     In the Create Transport Route popup, click the Extended Transport Control

 button at the bottom of the popup.  Make sure Consolidation is "on" and fill

 in the information using our Target Group as the Consolidation Target.

6.     Click the green check button to Save the change.

10. You now have a Transport Group.  Confirm the Disturbution of it to the other

    SAP Instances.

 

Configure TMS to Use SAP's Quality Assurance Functionality

 

A Quality Assurance system must have a) a delivery route leading from it to

another instance, and b) be the target of a consolidation route. See topic

Using Target Groups to Transport to Mulitple Clients in Two Different Instances

to fulfill the a) requirement.

 

1.        Log on to client 000 of your TMS Domain Controller SAP Instance.

2.        Go to transaction STMS.

3.        On the Transport System Management screen, click Overview -> Transport

    Routes.

4.  On the Display Transport Routes screen, click Display<>Change button to

    toggle into change mode.  Click on the instance in which you want to control

 QA.  Normally, this is QAS and the instance to be controlled is PRD. Under

 Transport Routes, click on the QAS instance and click Create.

5.  On the Create Transport Route screen, make sure Delivery is "on" and fill in

    Source and Delivery systems with QAS and PRD.  Click the green check mark to

 save. Now you have met condition a.
6.  Back on the Change Transport Routes screen, click on the QAS instance and

 click the single pencil Change button. You will see a Change System

 Attributes popup. Click "on" Quality Assurance - Delvery After Confirmation.

 If you want to change the people who OK the transports, click the

 Procedure button and make your changes. Then back out.  Click the green check

 to Transfer your changes.

7.  Back on the Change Transport Routes screen, click on the Target Groups line

    and click the Create button.  

8.  In the Create Transport Group popup, fill in the Target Group as /XXXCLNTS/,

    give a Short Description and click the Client Assignment button.  Be aware

    that the Target Group name must start and end with a “/”.  Enter each Target

    system and Target client you need.  Click the green check mark to Transfer.

    You now have a target group. Now you must create a Consolidation Layer.

9.  Back on the Change Transport Routes screen, click on Transport Routes and

    click Create.

10. In the Create Transport Route popup, click the Extended Transport Control

 button at the bottom of the popup.  Make sure Consolidation is "on" and fill

 in the information using our Target Group as the Consolidation Target.  Click

 the green check button to Save the change.

11. You now have a Transport Group.  Confirm the Disturbution of it to the other

    SAP Instances. 

12. You may now leave the STMS transactions.

 

      Automate the Transport Process

 

1.  Log on to client 000 of your TMS Domain Controller SAP Instance.

2.  Go to transaction STMS.

3.  On the Transport System Management screen, click Overview -> Imports.

    Double-click on the queue for the SAP instance are in. 

1.        On the Import Queue screen, click the Refresh button.  Click on the Import

 All Requests button.

5.  On the Start Import popup, fill in the information for the job. Make sure "At

 Start Time" is on. Although Period appears grayed out, you can still change

 it to the periodic value you need. I recommend every hour in DEV, 4 times a

 day in QAS, and once an evening in PRD.  Click on the green check mark to

 Continue.

      6.  You may now leave the STMS transaction.  If you ever need to change this job,

          you must do it via STMS and not SE37.

 

---

User Tasks

 

Creating, Modifying, and Deleting Users

 

      Creating a User

 

1.               Log on to the appropriate SAP system and the client where the new user is to be added.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the new User name and click the blank page picture-icon.

4.               On the Maintain User screen, fill in at least the following information for each tab:

 

Address           Last name, First name, Internet mail

Logon data        Initial password, repeat password, user type

Defaults          Decimal formation, Date formation, Time zone, OutputDevice

Roles             Select roles to be added to the user

Profiles          Select profiles to be added to the user

     

          When all necessary data has been entered, click the Save

    picture-icon.

5.               You will receive a User saved message in the status bar at the bottom of the screen.  You may now leave the SU01 transaction.

 

Copy an Existing User to a New User

 

1.               Log on to the appropriate SAP system and the client where the user is to be changed.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the User name to be copied and click the double blank page picture-icon.

4.               On the Copy User popup, type in the To for the new user and click the Copy button.

5.               On the Maintain User screen, click on the tabs and make the changes to the user’s information.  When you are done, click the Save picture-icon.  You will receive a User saved message in the status bar at the bottom of the screen. 

6.               You may now leave the SU01 transaction.

Modifying a User

 

1.               Log on to the appropriate SAP system and the client where the user is to be changed.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user’s name and click the pencil picture-icon.

4.               On the Maintain User screen, click on the tabs and make your user information changes.  When you are done, click the Save picture-icon.

You will receive a User saved message in the status bar at the bottom of the screen.  You may now leave the SU01 transaction

Deleting a User

 

1.               Log on to the appropriate SAP system and the client where the user is to be deleted.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user’s name and click the trash can picture-icon.

4.               On the Delete user popup, click the Yes button.

5.               You will receive a User deleted message in the status bar at the bottom of the screen.  You may now leave the SU01 transaction.

 

Locking a User

 

1.               Log on to the appropriate SAP system and the client where the user is to be locked.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user’s name and click the lock/unlock picture-icon.

4.               On the Lock user popup, click the lock picture-icon.

5.               You will receive a User locked message in the status bar at the bottom of the screen.  You may now leave transaction SU01.

 

Modifying a User’s Password

 

1.               Log on to the appropriate SAP system and the client where the user’s password is to be changes.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user’s name and click the lock/unlock picture-icon.

4.               On the Change Password popup, enter the new password in both the New password and Repeat password boxes.  Click the green √ picture-icon.

5.               You will receive a The password was changed message in the status bar at the bottom of the screen.  You may now leave the SU01 transaction.

 

Add a Role to a User

 

1.               Log on to the appropriate SAP system and the client where the user needs the role. Go to transaction SU01.

2.               On the User Maintenance: Initial Screen screen, type in the user’s name and press Enter to confirm that the user exists.

3.               Click the Change button or press Shift+F6.

4.               On the Maintain User screen, click on the Roles tab.  Fill in the name(s) in the field(s) provided, and when done press Enter.

5.               Click the Save button.

6.               Go to transaction PFCG, and on the Role Maintenance screen, type in the name of the role to which the users where added and press Enter to confirm exist of the role.

7.               Click the Change role little yellow pencil button. 

8.               On the Change Roles screen, click the User tab.  Click on User Comparison and then Complete Comparison.  Once the comparision is done, click Save one more time and you are done!

Mass User Changes

 

Making user changes one-at-a-time can be extremely time consuming not to mention boring.  SAP has provided mass change transaction to help eleviate the tediousness of making many user changes.  It should be noted, however, that the mass change transaction is limited as to the changes that can be made.  For example, you cannot change the password for multiple users.  Also note that it is best to make one type of mass change at a time.  For example, you need to add a new role to and delete an existing role from 20 users.  The best method to achieve this would be to first do a mass change to add the new role.  Save the changed users.  Then delete the existing role from the same 20 users. 

 

1.               Log on to the appropriate SAP system and the client where the user changes are to take place.

2.               Go to transaction SU10.

3.               On the User Maintenance: Mass Changes Initial Screen screen, you need to select whether you will select users based on Address Data or Authorization Data and click the appropriate button.  If you click Address Data, you can find users with any combination of First name, Last name, User ID, Company, City, Building, Room, Extension, Department, and Cost Center.  If you opt to use Authorization Data, you can specify a combination of Groups, Reference User, Authorizations, Athorization Objects, and many other fields.  For either method, fill in the fields you want to search on in the Users by Complex Selection Criteria screen, and click the Execute button.

4.               On the Users by Complex Selection Criteria screen, you can click “on” the users to be changed, or click the Select All button.  Once all the users you want to change have been selected, click the Transfer button.

5.               Back on the Maintenance: Mass Changes Initial Screen screen, you can select all the users on the screen again by clicking the Select All button or change your mind and make any last minute corrections.  Once you have all the users selected that you want to change, click User → Change.

6.               On the Mass User Changes screen, scroll through the tabs, changing data and clicking the Add or Remove button for each correction.  Please note, each SU10 batch run must use all Adds or all Removes but never a mixture.  Do all Adds in one run and then all Removes in another. Once all your changes have been made, click the Save button.

7.               On the Mass changes popup, you will see how many users you are about to change.  To make the changes, click on Yes. 

8.               On the Log Display screen, you will see a log of the changes you made.  Expand the list to see the transactional details.

9.               You may now leave the SU10 transaction.

 

User Information Repository Reports

 

1.               Log on to the appropriate SAP system and client where the user reports are to be generated.

2.               Go to transaction SUIM.

3.               On the User Information System screen, click the Infosystem authorizations entry on the navigation tree and click the double arrows pointing down picture-icon to expand the list of available reports.

4.               Click on the clock picture-icon to the left of the report you want to run.  You will be taken to a selection filter screen to customize the data you need to see on your report.  Once your report has been produced, you can print it or send it to your hard disk.

5.               You may now leave the SU01 transaction.

User Information Repository Reports

 

1.               Log on to the appropriate SAP system and client where the user reports are to be generated.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, from the top-most menu bar click Information → Information system.

4.               On the User Information System screen, click the Infosystem authorizations entry on the navigation tree and click the double arrows pointing down picture-icon to expand the list of available reports.

5.               Click on the clock picture-icon to the left of the report you want to run.  You will be taken to a selection filter screen to customize the data you need to see on your report.  Once your report has been produced, you can print it or send it to your hard disk.

6.               You may now leave the SU01 transaction.

Displaying and Dropping User Sessions

 

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM04.

3.               On the User List screen, all users currently logged on to the SAP system are displayed.  To delete a user’s session, place a √ in the □ to the left of the user to be dropped and click the Sessions button.

4.               On the Overview of Sessions popup, click on the session No to be deleted.  Click the End Session button.

5.               You will not receive a deletion confirmation message.  You may now leave the SM04 transaction.

 

---

Tracing a User’s Activity

 

      Creating a User Audit Profile

 

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM19.

3.               From the top-most menu bar on the Security Audit: Administer Audit Profile screen, click Profile → Create.

4.               On the Create new profile popup, type in a new Profile name and click the green √ picture-icon.

5.               On the Filter 1 tab of the Security Audit: Administer Audit Profile screen, click the □ to the left of Filter active to place a √ in the box.  In the Selection criteria section, select the Clients and User names to be traced.  In the Audit classes section, click “on” all the auditing functions you need for this profile.  In the Events section, click the radio button to the left of the level of auditing you need.  Once you have entered all your trace information, click the Save picture-icon.  You will receive an Audit profile saved in the status bar at the bottom of the screen.

6.               Please note that while the user trace has been saved, it is not yet active.  To activate the user trace, see the next section Activating a User Audit Profile.

7.               You may now leave the SM19 transaction.

Activating a User Audit Profile

 

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM19.

3.               On the Security Audit: Administer Audit Profile screen, select the audit profile to be activated from the Profile dropdown.  Click the lit match picture-icon to activate it.  You will receive an Audit profile activated for next system start in the status bar at the bottom of the screen.  The audit will not begin until after the SAP instance has been recycled.

4.               You may now leave the SM19 transaction.

Deactivating a User Audit Profile

 

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM19.

3.               On the Security Audit: Administer Audit Profile screen, select the audit profile to be deactivated from the Profile dropdown.  From the top-most menu bar, click the Profile → Deactivate.  You will receive a Current audit profile was deactivated in the status bar at the bottom of the screen. 

4.               You may now leave the SM19 transaction.

 

Deleting a User Audit Profile

 

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM19.

3.               On the Security Audit: Administer Audit Profile screen, select the audit profile to be deleted from the Profile dropdown.  Click the trash can picture-icon.

4.               On the Confirmation prompt popup, click the Yes button.  You will receive an Audit profile deleted in the status bar at the bottom of the screen. 

5.               You may now leave the SM19 transaction.

Viewing the Audit Analysis Report

 

1.               Log on to any client in the appropriate SAP system.

2.               Go to transaction SM20.

3.               In the Selection, Audit classes, and Events to select sections of the Security Audit Log: Local Analysis screen, provide your information to filter the audit information.  If you need to trace the activities of a specific user, be sure to include that user’s ID.  Click the Re-read audit log button.

4.               The resulting list is displayed.  This list can be printed using the usual methods.

5.               You may now leave the SM20 transaction.

---

Security Tasks

 

      Creating a User Role

 

The easiest way to create a new user role is to copy an already existing user role, either one of your own or one of the ones provided to you in the installation of SAP.  So let’s assume that you have none of your own and use one of the SAP role templates provided.  It might assist you with picking one of these roles if you have someone dump the appropriate information into a spreadsheet containing the Role Name, Role Description, Transactions contained in the Role, and the Transaction description.  The SQL query would be something like this:

 

SELECT AGR_TEXTS.AGR_NAME, AGR_TEXTS.TEXT, AGR_TCODES.TCODE, TSTCT.TTEXT
   FROM AGR_TEXTS, AGR_TCODES, TSTCT
WHERE AGR_TEXTS.MANDT = '000' AND
   AGR_TEXTS.SPRAS = 'E' AND
   AGR_TEXTS.LINE = 0 AND
   AGR_TCODES.MANDT = '000' AND
   AGR_TCODES.AGR_NAME = AGR_TEXTS.AGR_NAME AND
   TSTCT.SPRSL = 'E' AND
   TSTCT.TCODE = AGR_TCODES.TCODE
ORDER BY AGR_TEXTS.AGR_NAME, AGR_TCODES.TCODE;

 

This query should be changed based on the details of your SAP instance.  Identify the roles(s) to be used as the source for your role copy.

 

1.               Log on to client needing the role.

2.               Go to transaction PFCG.

3.               On the Role Maintenance screen, either type in the role name to be copied or select it from a dropdown.  Press Enter to confirm that the role exists.

4.               Click the Copy role button or press Shift+F11.

5.               One the Query popup box, fill in the to role field with the name to be given the new role.  Come up with a standard that everyone follows so the base original role is designated in some way so you don’t forget where you got the original.  The name must begin with Z or Y. Most people will add a Z- in the first two characters of the role name.  If you want to only select specific roles from a Composite role, you would click the Copy selectively button, otherwise click the Copy all button.

6.               Once the role has been copied, you will be taken back to the original PFCG screen where you will see the name of your new role.  Change you Role description and save the new role before working with it any further

 

Modifying a User Role

 

1.               Log on to client needing the role change.

2.               Go to transaction PFCG.

3.               On the Role Maintenance screen, either type in the role name to be changed or select it from a dropdown.  Press Enter to confirm that the role is found.

4.               Click the Change Role little yellow pencil button role button or press F6.

5.               Click the Authorizations tab and then the Change Authorization Data button.

6.               On the Change Role: Authorizations screen, expand and change the authorizations you need to adjust.  When finished click first the Save button and then the Generate button – looks like a little red and white beachball.

7.               Back out to the Change Roles screen and click the User tab.  Click on User Comparison and then Complete Comparison.  Once the comparision is done, click Save one more time and you are done!

 

Deleting a User Role

 

1.               Log on to client needing the role deletion.

2.               Go to transaction PFCG.

3.               On the Role Maintenance screen, either type in the role name to be changed or select it from a dropdown.  Press Enter to confirm that the role is found.

4.               Click the Role Delete button or Shift+F2.

5.               On the Delete Role popup, confirm that you wish to delete the deletion.  If you get an Information popup, confirm it also.

6.               Your deletion will return a successful message in the bottom status bar.

 

Transporting User Roles between Clients (Transport System Method)

 

When a modification is made to a role in the 100 client, the roles must be transported to the 800 client.  One role, several roles, or all roles can be done if needed.  They can all be added to the same transport change request.  After the roles have been moved to other clients, you will need to log on to each of those clients and do a user comparison.  You will also need to do a text comparison in client 100 of the appropriate SAP system.

 

1.               Log on to client 100 of the appropriate SAP system.

2.               Go to transaction PFCG.

3.               On the Role maintenance screen, type in the Role name of the first role to be transported.  Click the Truck picture-icon.

4.               You will see an Information popup.  Click the green √ picture-icon.

5.               In the Choose objects popup, unclick the □s beside User assignment and Personalization.  If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment.  Click the green √ picture-icon.

6.               On the Prompt for Customizing request popup, click the blank page picture-icon to create a new change request.  On the Create Request popup, fill in the Short description and click the Save picture-icon.  You will be returned to the Prompt for Customizing request popup which contains the generated change request number for this system change. Click the green √ to continue.

7.               You will see a Data entered in change request message in the status bar at the bottom of the screen.  Now enter the name of the next role to be transported and click the Truck picture-icon.

8.               You will see an Information popup.  Click the green √ picture-icon.

9.               In the Choose objects popup, unclick the □s beside User assignment and Personalization. If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment. Click the green √ picture-icon.

10.           On the Prompt for Customizing request popup, continue to use the same transport you created in step 6.  Click the green √ to continue.

11.           Continue to perform steps 7 through 10 until all the roles you need to transport have been attached to the transport change request.

12.           The generated transport can now be released and transported into the clients needing the modified roles.

13.           You may now leave the PFCG transaction.

Transporting User Roles between Clients (Upload/Download Method)

 

Central User Administration distributes clients and their information to the other clients connected to the Distribution Model.  It does not, however, do the same for roles and role authorizations.  So when a modification is made to a role in the 100 client, the roles must be transported to the 800 client.  One role, several roles, or all roles can be done if needed.  They can all be added to the same transport change request.  After the roles have been moved to other clients, you will need to log on to each of those clients and do a user comparison.  You will also need to do a text comparison in client 100 of the appropriate SAP system.

 

1.               Log on to client 100 of the appropriate SAP system.

2.               Go to transaction PFCG.

3.               On the Role maintenance screen, type in the Role name of the first role to be transported.  Click the Truck picture-icon.

4.               You will see an Information popup.  Click the green √ picture-icon.

5.               In the Choose objects popup, unclick the □s beside User assignment and Personalization.  If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment.  Click the green √ picture-icon.

6.               On the Prompt for Customizing request popup, click the blank page picture-icon to create a new change request.  On the Create Request popup, fill in the Short description and click the Save picture-icon.  You will be returned to the Prompt for Customizing request popup which contains the generated change request number for this system change. Click the green √ to continue.

7.               You will see a Data entered in change request message in the status bar at the bottom of the screen.  Now enter the name of the next role to be transported and click the Truck picture-icon.

8.               You will see an Information popup.  Click the green √ picture-icon.

9.               In the Choose objects popup, unclick the □s beside User assignment and Personalization. If you want to transport the users along with the role, profiles, and authorizations, you can √ the □ to the left of User assignment. Click the green √ picture-icon.

10.           On the Prompt for Customizing request popup, continue to use the same transport you created in step 6.  Click the green √ to continue.

11.           Continue to perform steps 7 through 10 until all the roles you need to transport have been attached to the transport change request.

12.           The generated transport can now be released and transported into the clients needing the modified roles.

13.           You may now leave the PFCG transaction.

Performing a User Comparison on the Modified Roles

 

1.               Log on to client 100 of the appropriate SAP system.

2.               Go to transaction PFCG.

3.               On the Role maintenance screen, type in the Role name of the first role to be transported.  Click the Change button.

4.               On the Change Roles screen, click the User tab.

5.               On the User tab, click the User compare button.

6.               On the Compare Role User Master Record popup, click the Complete compare button.

7.               You will receive a User master record for role was adjusted message in the status bar at the bottom of the screen.  You may now leave the PFCG transaction.

 

Performing a Text Comparison to Refresh Role Selection Lists

 

1.               Log on to client 100 of the appropriate SAP system.

2.               Go to transaction SU01.

3.               On the User Maintenance: Initial Screen screen, type in the user “model_user”.  Click the pencil picture-icon.

4.               On the Maintain User screen, click the Text comparison from child Syst. button.

5.               On the CUA: Text comparison from Child Systems screen, type “LSDEV100” for the Receiving system and “LSQAS800” for the to system.  This is a range, and since LSPRD300 falls alphabetically between LSDEV100 and LSQAS800, all three systems will have the text comparison performed.  Click the clock picture-icon.

6.               On the CUA: Text comparison from Child Systems results screen, you will see a list of the systems compared and the compare results.  Click the white arrow on green picture-icon 3 times, or until you have left the SU01 transaction.

Users, Roles, and Authorizations

 

SAP security is based on authorization objects and authorizations.  An authorization object is used to indicate that a user can perform a certain activity.  An authorization is used to limit the scope of that activity.

 

For example, a profile contains the S_DEVELOP authorization object.  This authorization object allows a user to perform ABAP workbench activities.  Some users will need to do all ABAP activites while others will only need to perform a few.  So S_DEVELOP has a selection of authorizations you can use:  ACTVT, DEVCLASS, OBJNAME, OBJTYPE, and P_GROUP.  The authorizations are set to the appropriate values as needed.  A tree view of the S_DEVELOP authorization object can be seen below:

 

            S_DEVELOP

 

                  ACTVT

                        Create or generate

                        Change

                        Display

                        Delete

                        Activate, generate

                        Execute

                        Create in DB

                        Delete in DB

                        Convert to DB

                        Administer

                        Copy

                        All Functions

                        Deactivate Mod. assistant

                  DEVCLASS

                        Single Value or Value Range

                  OBJNAME

                        Single Value or Value Range

                  OBJTYPE

                        Single Value or Value Range

                  P_GROUP

                        Single Value or Value Range

 

The S_DEVELOP authorization object in a profile lets a user perform ABAP workbench activities.  But having a S_DEVELOP authorization object with the ACTVT authorization value set to Display (03) means that the user is limited to display only in the ABAP workbench transactions.  Thus we see that authorization objects grant while authorizations limit.  It is important to remember, however, that a user with a profile having a S_DEVELOP with full authorizations still cannot access an ABAP workbench transaction until a matching S_TCODE (start up transaction code) has been added as well.  In other words, a user may have the rights to add, modify and delete ABAP programs but until an entry for SE38 has been added to the S_TCODE authorization object, he cannot access transaction SE38 which is the ABAP Editor.

 

All authorization objects and authorizations are grouped into profiles before being attached to users.  Profiles use a combination of authorization objects and their respective authorizations, and their creation can be complex as well as tedious.  In order to simplify the creation of profiles, the Profile Generator (transaction PFCG) was created.  Roles are created via a more user-friendly interface which generates profiles based on the information added via this interface.

 

Manually creating profiles is the “old” way of doing things.  There are times, such as the start of a new SAP landscape where no roles exist, that the use of profiles is handy.  But once the landscape has been completed all users, with the exception of the Basis team, should be attached to roles.  There should never be a need to manually create a SAP new profile.  To add a new role, the easiest method is to copy an existing role that matches your needs as closely as possible and make the changes you need for the new role.

 

This documentation covers changing user security via both methods.

 

Adding Authorization Objects and/or Authorizations to a Profile

 

Remember that profiles are NOT the standard way to implement SAP security

 

1.               Log on to the appropriate client in the appropriate SAP system.

2.               Go to transaction SU02.

3.               In the Manually edit authorization profiles section of the Profile: Initial Screen screen, enter the Profile you want to change.  Make sure the Active only □ is checked.  Click the Create work area for profiles button.

4.               On the Profile List screen, double-click the profile to be changed.

5.               A profile can contain authorization objects only (single profile) or one or more other profiles (collective profile).  If the next screen is titled Maintain Profile, this is a single profile, and you should proceed to the next step.  If the next screen is titled Collect Profiles, this is a collective profile and you should skip to step 13.

6.               On the Maintain Profile screen, you must decide if you need to add a new authorization object and one or more of its authorizations, or add a new authorization to an authorization object already in the profile.  If you need to add a new authorization to an authorization object already in the profile, skip to step 7.  Otherwise, scroll down the Consisting of authorizations list until you find a blank line.  Type the authorization object you need to add and press Enter.  You will need to scroll through the list again until you find the authorization object you just added (it is was to find since the Authorization column should still be blank).  Once you find the new entry line, use the drop down to fill in the Authorization column.  Click on the Save picture-icon.

7.               If you need to add another authorization to an authorization object already in the profile list, click on the +Add authorization button. 

8.               From the Maintain Profiles: Object Classes screen, double-click the Object class of the authorization you are adding. 

9.               On the Maintain Profiles: List of Authorizations screen, select the authorization you need to add by double-clicking the appropriate line.  This will return you to the Maintain Profile screen where you can see that your authorization has been added.

10.           On the Maintain Profile screen, click the Save picture-icon.  Then click the lit match picture-icon to activate the new profile changes.

11.           On the Activate Profile: Execution Screen screen, click on the lit match picture-icon to complete the profile activation process.

12.           You may now leave the SU02 transaction.

13.           In order the change a profile collection, you must make the changes in one or more of the dependent profiles, save the changes in the dependent profile(s), activate the dependent profile(s), save the collection owner profile, and activate the collection owner profile.  On the Collect Profiles screen, double-click on the profile you want to change.

14.           You will be taken to the Maintain Profile screen.  Perform steps 6 to 11.  Then use the white arrow on green picture-icon to go back.

15.           On the Collect Profiles screen, click the Save picture-icon.  Then click the lit match picture-icon to activate the new profile changes.

16.           On the Activate Profile: Execution Screen screen, click on the lit match picture-icon to complete the profile activation process.

17.           You may now leave the SU02 transaction.

 

Adding Authorization Objects and/or Authorizations to a Role

 

1.               Log on to client 100 in the DEV SAP system.

2.               Go to transaction PFCG.

3.               On the Role Maintenance screen, enter the Role you want to change.  Click the Change button.

4.               On the Change Role screen, click the Authorizations tab and then click the pencil picture-icon.

5.               If you are only adding a start up transaction to the role, skip to step 10.  Otherwise, the assumption is that a new authorization object is to be added. On the Change role: Authorizations screen, click the +Manually button.

6.               On the Manual selection of authorizations popup, enter the authorizations objects that need to be added (ie S_DEVELOP, S_PROGRAM, etc.)  Click the green √ when you are finished.

7.               Back on the Change role: Authorizations screen, if all the displayed signal lights are green, skip to step 8.  Otherwise, fully expand the lines that are yellow and/or red and supply the necessary information.  All signal lights should be green before moving to the next step.

8.               On the Change role: Authorizations screen, click the Save picture-icon.  You will receive a Data saved confirmation message in the status bar at the bottom of the screen.

9.               On the Change role: Authorizations screen, click the red-and-white beach ball picture-icon to generate a profile from the saved role.  Reply affirmatively if any confirmation popups.  You will receive a Profile(s) created message in the status bar at the bottom of the screen.  If you do not need to add any start up transactions to the profile, you may now leave the PFCG transaction.

10.           On the Change Role: Authorizations screen, expand the Cross-application Authorization Objects → Authorization Check for Transaction Start → Authorization Check for Transaction Start until you see the Transaction code entry line.  Double-click on the entry portion of the Transaction code line.

11.           In the Maintain Field Values popup, scroll down the list until you find a blank From and To line.  Enter the transaction(s) to be added, and click the Save picture-icon when you have finished. 

12.           On the Change role: Authorizations screen, click the Save picture-icon.  You will receive a Data saved confirmation message in the status bar at the bottom of the screen.

13.           On the Change role: Authorizations screen, click the red-and-white beach ball picture-icon to generate a profile from the saved role.  Reply affirmatively if any confirmation popups.  You will receive a Profile(s) created message in the status bar at the bottom of the screen. 

14.           You may now leave the PFCG transaction.

 

Granting Transaction Access to a User via Profile

 

*** Since SAP R/3 4.5, this is not the standard for user authorizations.

***

Granting Transaction Access to a User via Role

 

1.        Log on to the applicable SAP instance and client.

2.        Go to transaction SU01.

3.        On the User Maintenance: Initial Screen screen, fill in the User ID for the user you want to change, either by typing it in or choosing it from the drop down.  Click the little yellow pencil Change button.

4.        On the Maintain User screen, click on the Roles tab.  Fill in the new role in the first available Role field.  Press ENTER to confirm that the role exists.  Click the Save button.

5.        Make sure to use transaction PFCG to run a user comparion to rebuilt the role-to-user connections.

6.        You may now leave the PFCG transaction.

Revoking Authorizations from a User via Profile

 

*** Since SAP R/3 4.5, this is not the standard for user authorizations.

***

Revoking Authorizations from a User via Role

 

Use the same procedure as Adding Authorization Objects and/or Authorizations to a

Role

 

Revoking Transaction Access from a User via Profile

 

*** Remember that profiles are NOT the standard way to implement SAP security. ***

Attaching a Profile to a User

 

*** Since SAP R/3 4.5, this is not the standard for user authorizations.

***

 

Attaching a Role to a User

 

1.        Log on to the applicable SAP instance and client.

2.        Go to transaction SU01.

3.        On the User Maintenance: Initial Screen screen, fill in the User ID for the user you want to change, either by typing it in or choosing it from the drop down.  Click the little yellow pencil Change button.

4.        On the Maintain User screen, click on the Roles tab.  Fill in the new role in the first available Role field.  Press ENTER to confirm that the role exists.  Click the Save button.

5.        Make sure to use transaction PFCG to run a user comparion to rebuilt the role-to-user connections.

6.        You may now leave the PFCG transaction.

---

Client Tasks

 

Client Copies within the Same SAP System

 

*** SAP’s terms for the sending and receiving clients can be confusing.  The “target” client is the client into which data is to be copied.  The “source” client is the client which contains the data to be copied.  Also, remember that all client copies are destructive and will delete all data before copying in the new data.  The only exception is when the SAP_USER profile is used.  In this case, only user master data is deleted from the target client before the new user master data is copied.  ***

 

1.               Create the target client if necessary.

2.               Log on to the target client in the appropriate SAP system.  If the target client is new, use “SAP*” for the user and “pass” for the password.

3.               Go to transaction SCCL for Local Client Copy.

4.               On the Client Copy – Copy a Client screen, use the Selected profile dropdown to select a profile that matches your needs.  Use SAP_ALL or SAP_UAPP to copy all data except change documents, SAP_USER to copy only user master data, or one of the other SAP provided client copy profiles. Type the Source client and Source client user masters in the provided boxes.  These two boxes should contain the same client number unless the data is to come from one client and the user master data from a different client.  Once all information has been provided, click the Schedule as background job button.  If you receive a Change documents will not be copied message in the bottom status bar, click the green √ next to the transaction command field at the very top of the screen to continue.

5.               On the Schedule Client Copy in Background screen, use the Background server dropdown to select the background server on which the job is to run.  There should only be one server available in the dropdown.  Click the Schedule job button.

6.               On the Verification popup, check that everything is correct and click the Continue button.

7.               On the Start Time popup, if you want the client copy job submitted right away, click the Immediate button.  To schedule the copy for a later date and/or time, click the Date/Time button.  In the Date/Time section, provide the Scheduled start Date and Time.  If you are unsure as to the format of date and time, click on the top-most menu bar System → User profile → Own data.  Click on the Defaults tab to see your default date format.  If the user is SAP* due to a new client, you may receive a date validation error if you use the date format of MM-DD-YYYY.  Try other variations such as DD.MM.YYYY, MM/DD/YYYY, YYYY.MM.DD, YYYY/MM/DD, and YYYY-MM-DD.  Click the Save picture-icon.

8.               On the Background Print Parameters popup, select an Output device from the dropdown.  Click the green √ to continue.

9.               You will receive a client copy confirmation message.  You can monitor this copy by using transaction SCC3.  You may now leave the SCCL transaction.

Client Copies between Different SAP Systems

 

*** SAP’s terms for the sending and receiving clients can be confusing.  The “target” client is the client into which data is to be copied.  The “source” client is the client which contains the data to be copied.  Also, remember that all client copies are destructive and will delete all data before copying in the new data.  The only exception is when the SAP_USER profile is used.  In this case, only user master data is deleted from the target client before the new user master data is copied.  ***

 

1.               Create the target client if necessary.

2.               Log on to the target client in the appropriate SAP system.  If the target client is new, use “SAP*” for the user and “pass” for the password.

3.               Go to transaction SCC9 for Remote Client Copy.

4.               On the Client Copy – Copy a Client screen, use the Selected profile dropdown to select a profile that matches your needs.  Use SAP_ALL or SAP_UAPP to copy all data except change documents, SAP_USER to copy only user master data, or one of the other SAP provided client copy profiles. Since this is a client copy that uses data from a client in another SAP system (or remote client), a Source destination must be provided.  This is a RFC connection pointing to a specific client in another SAP system.  If there is no RFC connection to the client you wish to copy, you will need to create one.  Otherwise, use the dropdown to select the remote source client.  To test that your select Source destination RFC connection will work, click the RFC system check button. Once the proper remote source client has been selected, the System name and Source client boxes will fill automatically.  Once all information has been provided, click the Schedule as background job button.  If you receive a Change documents will not be copied message in the bottom status bar, click the green √ next to the transaction command field at the very top of the screen to continue.

5.               On the Schedule Client Copy in Background screen, use the Background server dropdown to select the background server on which the job is to run.  There should only be one server available in the dropdown.  Click the Schedule job button.

6.               On the Verification popup, check that everything is correct and click the Continue button.

7.               On the Start Time popup, if you want the client copy job submitted right away, click the Immediate button.  To schedule the copy for a later date and/or time, click the Date/Time button.  In the Date/Time section, provide the Scheduled start Date and Time.  If you are unsure as to the format of date and time, click on the top-most menu bar System → User profile → Own data.  Click on the Defaults tab to see your default date format.  If the user is SAP* due to a new client, you may receive a date validation error if you use the date format of MM-DD-YYYY.  Try other variations such as DD.MM.YYYY, MM/DD/YYYY, YYYY.MM.DD, YYYY/MM/DD, and YYYY-MM-DD.  Click the Save picture-icon.

8.               On the Background Print Parameters popup, select an Output device from the dropdown.  Click the green √ to continue.

9.               You will receive a client copy confirmation message.  You can monitor this copy by using transaction SCC3.  You may now leave the SCC9 transaction.

Client Copy Variations

 

      Limiting a Client Copy to Refresh User Master Data

 

Sometimes you need to retain the data residing in a client but refresh the roles, users, and other security components that have changed in DEV client 100.  Since role changes don’t transport across the other clients maintained via Central User Administration, a user master client copy can be used on any client in the SAP landscape.

 

1.               Log on to the appropriate client on the appropriate SAP system.

2.               If the user master data is coming from a client within the same SAP system, go to transaction SCCL.  If the user master data is to be copied from a client in another SAP system, go to transaction SCC9.

3.               On the Client Copy – Copy a Client screen, use the Selected profile dropdown to select profile “SAP_USER”. Type in the same client for both the Source client and Source client user masters.  This should be the client that contains the user master data you want to copy.  If this is a user master copy that uses data from a client in another SAP system (or remote client), a Source destination must be provided. Once all information has been provided, click the Schedule as background job button.  If you receive a Change documents will not be copied message in the bottom status bar, click the green √ next to the transaction command field at the very top of the screen to continue.

4.               On the Schedule Client Copy in Background screen, use the Background server dropdown to select the background server on which the job is to run.  There should only be one server available in the dropdown.  Click the Schedule job button.

5.               On the Verification popup, check that everything is correct and click the Continue button.

6.               On the Start Time popup, if you want the client copy job submitted right away, click the Immediate button.  To schedule the copy for a later date and/or time, click the Date/Time button.  In the Date/Time section, provide the Scheduled start Date and Time.  If you are unsure as to the format of date and time, click on the top-most menu bar System → User profile → Own data.  Click on the Defaults tab to see your default date format.  Click the Save picture-icon.

7.               On the Background Print Parameters popup, select an Output device from the dropdown.  Click the green √ to continue.

8.               You will receive a client copy confirmation message.  You can monitor this copy by using transaction SCC3.  You may now leave the SCCL or SCC9 transaction, whichever is appropriate.

Viewing the Client Copy Logs

 

1.               Log on to any client in the “target” SAP system.

2.               Go to transaction SCC3.

3.               On the Client Copy/Transport Log Analysis screen, click the All clients button.

4.               From the list of Client copy logs, double click on a client to view summary information for all client copies where this client was the target client.  Double click on any of these summary lines to see statistics for a particular copy client job.

You may now leave the SCC3 transaction.

 

Creating and Deleting Clients

 

Creating a Client

 

*** Before adding a new client you should first ask if it will be used in communications with other clients (Central User Administration, source for client copies, etc.)  If so, the new client will need to be assigned a Logical System ID that is unique among all the SAP systems in the landscape.  It is recommended that all new clients be assigned to a Logical System ID as soon as they are created. ***

 

1.               Log on to any customizable client in the appropriate SAP system.

2.               Go to transaction SCC4.

3.               On the Display View “Clients”: Overview screen, click the pencil and glasses picture-icon to switch into change mode.

4.               On the Display View “Clients”: Overview popup, click the green √ to dismiss the informational message.

5.               On the Change View “Clients”: Overview screen, click the New Entries button.

6.               On the New Entries: Details of Added Entries screen, fill in Client number and description and the City.  Use the Logical system dropdown to assign a logical system ID to the client.  Type “USD” in the Std currency box.  Select a Client role from the client role dropdown (remember that there can only be one Productive client per SAP system).  In the Changes and transports for client-specific objects, Client-independent object changes, Protection: Client copier and comparison tool, and Restrictions when starting CATT and eCATT sections, select the necessary restriction levels from the provided dropdowns.  Once all information has been provided, click the Save picture-icon.

7.               You will see a Data saved in the status bar at the bottom of the screen.  You may now leave the SCC4 transaction.

 

Deleting a Client

 

1.               Log on to the client to be deleted.

2.               Go to transaction SCC5.

3.               On the Delete Client screen, verify that you are deleting the correct client.  If you also want the client deleted for T000 (ie the scc4 entry), put a √ in the □ to the left of Delete entry from T000 by clicking the □.  Click the Background button.

4.               On the Schedule Client Copy in Background screen, use the Background server dropdown to select the background server on which the job is to run.  There should only be one server available in the dropdown.  Click the Schedule job button.

5.               On the Verification popup, check that everything is correct and click the Continue button.

6.               On the Start Time popup, if you want the client delete job submitted right away, click the Immediate button.  To schedule the delete for a later date and/or time, click the Date/Time button.  In the Date/Time section, provide the Scheduled start Date and Time.  If you are unsure as to the format of date and time, click on the top-most menu bar System → User profile → Own data.  Click on the Defaults tab to see your default date format.  Click the Save picture-icon.

7.               On the Background Print Parameters popup, select an Output device from the dropdown.  Click the green √ to continue.

8.               You will receive a client copy confirmation message.  Don’t panic, it looks like a client copy confirmation and says nothing about this being a delete job.  You can monitor this copy by using transaction SCC3.  You may now leave the SCC5 transaction.

Restriction Change Levels in a Client

 

      When adding a new client to a SAP system, the information listed in

      the SCC4 can be confusing.  This is a brief explain of the

available client restrictions.

 

      Client role:

 

            The category indicates the role of the client in your R/3

            system.

 

     Possible roles are:

 

            *     Production client

            *     Test client

            *     Training client

            *     Demo client

            *     Customizing client

            *     SAP reference client

 

            This field should be maintained by the customer for

Documentary purposes. Release 3.0 also ensures the following:

 

If there is a productive client in the target system, no client copy (remote copy) which also selects cross-client customizing objects may be imported into the system. If cross-client settings are imported, inconsistencies may occur in all clients.

 

In a productive client, customizing settings that can be maintained as "current settings" can be excluded from a client lock or transport links; this means current settings (e.g. exchange rates, posting periods) can always be maintained in a productive client without recording changes. SAP is planning to link further effective functionality to this flag, to enable adequate protection of a productive client in a system with further (test) clients.

 

     

Other settings for a client:

 

            Change and transports for Client Dependent Objects

                 

Changes without automatic recording – the client can be customized although the system will not generate change requests.

           

Automatic recoding of changes – the client can be customized and all changes are generated into change requests.

 

No changes allowed – no modifications can be made to the client – it is protected or locked.  This is the usual configuration for a production client where customization should not be performed.

 

                  No transports allowed – changes are allowed but cannot be

                  transported.

 

            Client-Independent Object Changes

 

Changes to repository and client-independent customizing allowed – no restrictions on this client for changes and development.

 

No changes to client-independent customizing objects - allows for development on repository objects but not client-independent customizing.

 

No changes to repository objects – lets users perform client-independent customizing but no development or modifications to repository objects.

 

No changes to repository and client-independent customizing objects – this setting prohibits any client-independent modifications and is common on Production systems.

Creating a Logical System ID to be Assigned to a Client

 

A logical system gives a client a unique “name” which can be referenced by other clients within the SAP landscape.  Once you have created a logical system, use the SCC4 transaction to assign the logical system to a client.  Normally, you create the logical system before creating a client so that both start out together.  Adding a logical system to a client after the client has been in existence and in use to a long time period could cause referencing problems between that client and the rest of the SAP systems.

 

1.               Log on to any customizable client in the appropriate SAP system.

2.               Go to transaction SALE.

3.               On the Display IMG screen, expand the navigation tree like so:

 

Application Link Enabling (ALE)

Sending and Receving Systems

Logical Systems

Define Logical System

 

4.  On the Display IMG screen, click the clock picture-icon to the

left of Define Logical System.

5.  On the Display IMG popup, click the green √ button to dismiss

the informational message.

1.               On the Change View “Logical Systems”: Overview screen, click the New Entries button.

2.               On the New Entries: Overview of Added Entries screen, fill in the Log. System and Name. The logical system should match the naming convention already in place:  LS<SID><Client Number>, such as “LSDEV100” for DEV Client 100.  The description should be uniform as well such as “Logical System for DEV Client 100”.  Click the Save picture-icon.

3.               On the Prompt for Workbench request popup, click the blank page picture-icon to create a new change request.  On the Create Request popup, fill in the Short description and click the Save picture-icon.  You will be returned to the Prompt for transportable Workbench request popup which contains the generated change request number for this system change. Click the green √ to continue.

4.               You will receive a Data saved message in the status bar at the bottom of the screen.  You may now leave the SALE transaction.

---

Communications Tasks

 

Creating, Modifying, and Deleting RFC Connections

 

      Creating a RFC Connection

 

1.               Log on to any client on the appropriate SAP system.

2.               Go to transaction SM59.

3.               On the Display and maintain RFC destinations screen, click the Create button.

4.               On the RFC Destination screen, type in a RFC destination name.  This name should contain meaningful information such as the SID of the SAP system and/or any client numbers.  Select the Connection type from the connection type dropdown, and type the connection specifics in the Description box.  If the connection type is a “3” (another SAP system), fill in the necessary client logon information in the Logon section.  Fill in the Language, Client, User, and Password for an existing user in the target RFC SAP system.  This user should be a system or communication user (ie RFC_USER or ALEREMOTE), not a dialog user.  Once all this information is provided, press Enter.

5.               In the Technical settings section of the RFC Destination screen, type in the name or IP address of the Target host.  If the target is another SAP system, enter the number of System number (00 for all SAP systems except BW QAS which needs a 01).  Press Enter.

6.               On the RFC Destination screen, click the Save picture-icon.  You will receive a Destination saved message in the status bar at the bottom of the screen.  You may now leave the SM59 transaction.

Modifying a RFC Connection

 

1.               Log on to any client on the appropriate SAP system.

2.               Go to transaction SM59.

3.               On the Display and maintain RFC destinations screen, expand the appropriate RFC destination navigation level and double click the RFC destination to be changed.

4.               On the RFC Destination screen, make any necessary changes.  Once the information is changed, click the Save picture-icon. 

5.               You will receive a Destination saved message in the status bar at the bottom of the screen.  You may now leave the SM59 transaction.

Deleting a RFC Connection

 

1.               Log on to any client on the appropriate SAP system.

2.               Go to transaction SM59.

3.               On the Display and maintain RFC destinations screen, expand the appropriate RFC destination navigation level and click the RFC  destination to be deleted.  Click the Delete button.

4.               On the Delete destination popup, click the Yes button.

5.               You will not receive a confirmation message.  You may now leave the SM59 transaction.

 

 

 

 

 

See also

 

http://sites.google.com/site/saparchives/Home-SAP-BASIS

http://sites.google.com/site/saparchives/sap-basis-transactions

http://sites.google.com/site/saparchives/Home-SAP-BASIS/SAP-BASIS--unknown-sap-tricks

http://sites.google.com/site/saparchives/SAP-BASIS-everything-about-sap-clients

http://sites.google.com/site/saparchives/frequently-used-procedures

http://sites.google.com/site/saparchives/SAP-BASIS-BASICS

http://sites.google.com/site/saparchives/SAP-BASIS-what-is-asap

http://sites.google.com/site/saparchives/SAP-BASIS-configuration

http://sites.google.com/site/saparchives/SAP-basis-operation---unix--linux

http://sites.google.com/site/saparchives/SAP-basis-operation-2---unix--linux

http://sites.google.com/site/saparchives/SAP-basis-operation-3-unix--linux

http://sites.google.com/site/saparchives/SAP-basis-operation-1---windows

http://sites.google.com/site/saparchives/SAP-basis-operation-2---windows

http://sites.google.com/site/saparchives/SAP-basis-operation-3---windows

http://sites.google.com/site/saparchives/SAP-basis-interview-questions

http://sites.google.com/site/saparchives/sap-training-courses-ecc-60

http://sites.google.com/site/saparchives/sap-basis-refference-steps-1

http://sites.google.com/site/saparchives/SAP-basis-transactions

 

 

 

 

SAP BASIS - INDIA