topic Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing in Application Development and Automation Discussions

Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Wed, 27 Aug 2008 15:18:17 GMT

Now the upgrade has reached the "POST Upgrade Steps" which means Its open to the SECURITY ( Authorizations ) to come in.

1. First I have doing the SU25.

Question -->Do I need to run (1) on SU25 .

Answer:NO this is only for IInstallation of PFCG. for upgrading to higher releases only Steps 2 down are needed.

Please correct me if I am wrong or have additional information which you want to share

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Wed, 27 Aug 2008 18:56:40 GMT

Here 2A was executed...no problem. went well

Now In 2B I get a framed screen

On the right its the status colored red against the TCD ..any idea what needs to be done here ?

On double clicking the status I get on the right frame the status and the object --> The Check Indicator.

What needs to be done here ? Any expericences??

Edited by: george G on Aug 27, 2008 9:03 PM

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Thu, 28 Aug 2008 07:00:44 GMT

Hi George,

For security upgrade u need to do following steps :-

First run the SU25 2A, 2B ,2C, 2D steps successfully.

2A and 2B steps just compares the old system tcodes and new system tcodes.

Step 2C - shows the list of roles that are affected in upgrading.

Step 2D - shows the new tcodes introduced in new systems.

First complete the 2C step, click on one by one role it will get the screen of authorization objects , where as u can see the new authorizations that are got addeded.

There are three types of new authorization objects get introduced while upgrading :-

Standard New - it is the standard authorization objects introduced for corresponding new tcodes.

Manually new - It shows the authorization objects which were manually added in old system. Some of the values got updated for this also.

Standard Updated - Updated means , in old system if you have kept the standard values as it is, SAP has updated these standard values( u can check this one in SU24 check indicators).

After maintaining all new authorization objects , you can save it and generate the profile.The back to SU25 2C step shows it as green signal.

SU25, 2C step also contains the new SAP roles introduced.

After generating all profiles in SU25 2C step, you can jump to 2D step.

SU25 2D step-

If you execute these step, it will show the list of roles and old tcode and corresponding new tcode.

If business wants to use new tcode , then u can replace old tcodes by new one by clicking on automatically adjust menu. Otherwise go to manually adjust menu and generate the profile.

The new tcodes are introduced in 2D step , this doesn't means the old tcodes are no longer exists in new system. We have to check manually for each and every tcode.Some tcode does not exists in new systems. FOr e.g. RZ02 is replaced by RZ20 in ECC6. RZ02 no longer existss in ECC6.

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Thu, 28 Aug 2008 13:37:29 GMT

Sneha !!

Dont know if must congratulate you or Thank you - but here is both !

I have finished 2A & 2B --> Fundamentally I had ' Nothing to do " here !!

I am now maintianing the roles in 2C.

My question is once I maintian the roles each one by one in 2C, I dont have an option to transport the roles.

Are these transports done on step 3 ??will all my green colored roles go ??

Or Do I do this in PFCG ??

I searched the WEB/ Posted many questions but you are the first one to give an indepth reply. When none was replying I wanted to create a complete auth up grade document and give it to Julus ( may be he could learn too!!) This contribution of yours I will include !

Thanks again !

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Thu, 28 Aug 2008 16:30:33 GMT

Hi,

In any upgrade you should check the contents of the table PRGN_CORR2 that "drives" the SU25 process.

I have done upgrades before and then found that PRGN_CORR2 was actually missing values, so roles and transactions that need to be upgraded are not shown when you run step 2.d

OSS note 991377 contains two "must read" files of transactions that might not be in PRGN_CORR2 or have been replaced, sometimes without a replacement transaction.

Checking the contents of this table before you do much more on your role upgrades could save a lot of pain during the regression testing of your revised roles.

If you are on a fairly up to date support package level you might be ok.

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Thu, 28 Aug 2008 20:00:29 GMT

Good ! We are up to date on the support packs but the info was unique and supportive glad that this posting itself is developing itnto a total security upgrade.

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Fri, 29 Aug 2008 05:55:43 GMT

Hi George,

To transport the roles , I have done it through PFCG only.

Step -3 transport the initial customer tables. If you tranport through PFCG , then it will be better.

Many thanks,

Sneha

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Wed, 24 Sep 2008 13:11:27 GMT

Sneha,

After 2C, I do the following :

1> Go into PFCG and and maintain the roles there.

2> Put the role in the transport

My question at this point are the follwoing:

A>Do I need to maintian it in step 2c itself or what I am doing in PFCG is right ?

B> Once I complete the maintaining in PFCG and putting it in Transport, when the Next Box is upgraded Do i need to again go through the whole su 25 again -- I guess not

C> Do I need to do the step 3 ?- Its again a trnasport but I f I am doing it on PFCG then I cando away with this ??

Thanks

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Thu, 23 Oct 2008 15:56:40 GMT

Hi George - I am on the same page as you are, however I completed this task few days back - want to add what I analysed to answer your questions:

A> You will meet your task either way, for instance if you click the role with red light in Step:2C...it will take you to Maintain 'Authorization' tab- Change Mode within PFCG. So either way you can Edit and Generate role, but I would suggest you to dowload to local file and work 1by1 in PFCG so that you can keep track of work and make some notes.

B>It depends on how your Basis defined Transport Route between clients, In our scenario role transport from PFCG will move roles from DEV-QA-PRD..net..net..what I think is there is no need to run SU25 again.

C>If you follow above steps than I would suggest you to skip this step as PFCG role transport will take care...However if you decide to Generate roles under Step:2C, its wise to perform step 3.

All the Very Best.

Thanks!

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Mon, 09 Feb 2009 21:59:23 GMT

Hi,

From an " Audit " perspective how did you all handle this upgrade , scope of this discussion limited to the security part ?

What did the auditors want to see ? how did you keep yourself safe ..etc

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Mon, 09 Feb 2009 22:12:01 GMT

all the posts in this thread seems to be referring to some document. can you please tell me where this document is located. this thread is very interesting and I definitly want to know more about it.

thanks all

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Mon, 09 Feb 2009 23:17:16 GMT

The "documentation" being refered to is the "Information" button in transaction SU25 and the application help for the same transaction.

For a major release upgrade, and depending on how your legacy roles were built, such a change is also an opportunity to start over again... as the SU25 steps will only upgrade "intact" roles and there are many days, lessons learnt and some program errors between 46C and 7.00.

Cheers,

Julius

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Wed, 11 Feb 2009 07:21:13 GMT

Hi George,

To keep yourself safe , and from audit perspective , it is always good to perform upgrade on Dev and test system. While transporting any role changes to production follow the same change management procedure. We have taken proper approvals for all the role changes we have made during upgrade.

Regards,

Sneha

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Wed, 18 Feb 2009 16:47:25 GMT

Yeah I agree there is lot of Info on SU25 this pertains to "actual upgrade" also the auditors are very particular on the "risk " as in SoD/ GRC. We can take an " before " and "after" snap shot and then adress that.

I am doing it on dev ( two of them ) and others on lansscape

I am also developing the documentation from Audit perspective-- shall share it here - If Juluis agrees

Glad that so many are being benefitted by this post !

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Thu, 19 Feb 2009 08:06:02 GMT

> If Juluis agrees

No necessity for me to agree. I only maintain a negative list of things not to do...

I would recommend using a wiki for this. That way we can collaborate in building it further.

Cheers,

Julius

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Thu, 19 Feb 2009 17:22:57 GMT

On the lighter note-- we will need to put Juluis on the wiki too ! infact we can do away with all the entries on the wiki and place julu there !

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Tue, 03 Mar 2009 14:48:28 GMT

Now from the Audit stand point.

1. SU25 Gives us both the roles that are affected as well as the Transactions that effected.

Now here is the question from the Auditors:

" Please show us the evidence of what you did which each of the role ?" - I am certian you folks will agree with me that there are innumerable objects that are maintained. All the same I want to do this in a collabrative manner with auditors as they are doing their job.And to them their question is right.

Now my question here is are there any place where I can show the objects " before " the after ? some table etc ?/

Also I dont know if we ought to move this to anotehr topic termed " audit something ??" or post security upgrade processes " -- if so Julkuius please go ahead.

Thanks

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Tue, 03 Mar 2009 15:21:31 GMT

Show them how to use tx RSSCD100_PFCG and let them get on with it.....

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Tue, 03 Mar 2009 15:37:20 GMT

Alex- thanks for your Suggestion, however I doubt if that would sell with the auditors !

Do we have a table which says the objects assocoted with each role ? My idea is I can take a " before " & " After " back up of this -- how does this sound to my collegues ?

Re: Upgrade 46C to ECC 6 0 STEP BY STEP ---Developing

Former Member — Tue, 03 Mar 2009 20:39:54 GMT

Hi George,

It works if you sell it right......I would give them the tools and let them get on with it. (Something I prefer to do when auditing).

You could have a look at USOBX_CD and USOBT_CD which show the change docs for the SU24 tables. It may show change indicator changes which are a precursor to the updating each of the roles. As there is inevitably some changes you need to do to the roles, they are far better off review the upgrade related changes in their entirety in the context of the roles which have been changed.