topic Re: user lock in Application Development and Automation Discussions

user lock

Former Member — Fri, 29 Aug 2008 07:34:45 GMT

Hello experts,

How can we lock all users leaving the standard users like DDIC SAP* EARLYWATCH and SAPCPIC.

without using SU10.

regards,

kavitha

Re: user lock

jurjen_heeck — Fri, 29 Aug 2008 07:36:02 GMT

Why "without using SU10"?

Re: user lock

Former Member — Fri, 29 Aug 2008 07:39:51 GMT

hi kavitha,

go to se38----> enter EWULKUSR and execute

then click on choose user, check the users you don't want to lock and then save it,

after saving, click on lock users,

it will lock all the users that u have not selected

Alternative,

run tcode EWZ5, it will take you on same screen

regards,

tarun

Re: user lock

Former Member — Fri, 29 Aug 2008 07:52:42 GMT

Hi Kavitha,

There is one more way to lock the users by using USR02 table.

In USR02 table , u can update the UFLAG field which indicated , whether the user is locked.

0 User not locked

32 (Hex 20) Locked by CUA central administrator

64 (Hex 40) Locked by administrator

128 (Hex 80) Locked after failed logon

If you update the same field for all standard users in table.

Then use get locked automatically.

Re: user lock

Former Member — Fri, 29 Aug 2008 08:12:09 GMT

In USR02 table , u can update the UFLAG field which indicated , whether the user is locked.

Sneha,

Do you think it correct to directly manually update an SAP standard table?

Re: user lock

Bernhard_SAP — Fri, 29 Aug 2008 08:26:22 GMT

...looking forward to the next audit.....

Have fun....

Re: user lock

Former Member — Fri, 29 Aug 2008 11:52:45 GMT

I can hear chanting and the sound of coconuts being knocked against each other...

Re: user lock

Former Member — Fri, 29 Aug 2008 18:42:30 GMT

Hi,

Just adding some more to this....

You can also use function module "SUSR_USER_LOCK" to lock users and "SUSR_USER_UNLOCK" to unlock.

A custom development with these two function module is also a good option.

By the way, why you want a hard way out when you have the SAP's easy way out. ("without using SU10") ?

Regards,

Zaheer

Re: user lock

Former Member — Fri, 29 Aug 2008 18:44:01 GMT


> ...looking forward to the next audit.....
> Have fun....

Yups, i agree with Bernhard, direct updates in SAP tables is not a good practice, specially when you have audit folks running around.

Re: user lock

Former Member — Fri, 29 Aug 2008 19:36:58 GMT

> You can also use function module "SUSR_USER_LOCK" to lock users and "SUSR_USER_UNLOCK" to unlock.

You should use BAPI_USER_LOCK and BAPI_USER_UNLOCK.

> A custom development with these two function module is also a good option.

See transaction BAPI (Basis => Security).

> By the way, why you want a hard way out when you have the SAP's easy way out. ("without using SU10") ?

You might want to take a more granular control of the locking / unlocking (e.g. the user type... in addition to the user group) than what SU10 offers. Or possibly, you don't want to lock users for whom the account validity is not (yet) valid. You can code those requirements into your custom application, before you call the BAPI.

Cheers,

Julius

Re: user lock

Former Member — Fri, 29 Aug 2008 20:05:37 GMT

Agreed.

We also have a custom program built to have all IDs locked in system except standard SAP IDs and couple of support team IDs for regular system maintenance activities.

It all depends on what Kavitha is looking for..

Regards,

Zaheer

Re: user lock

Former Member — Sat, 30 Aug 2008 06:18:47 GMT

Hi all,

Thanks for all your answers.

but my doubt was , if we have some 5000 users in that case, i think it will be a bit hard to do it from SU10.

so does SUSR_USER_LOCK and BAPI_USER_LOCK only locks USERS leaving the sap standard users.

regards,

kavitha

Re: user lock

Former Member — Sat, 30 Aug 2008 07:37:15 GMT

The BAPI's will do exactly that which you tell them to do, if this is correct and you are authorized to.

So, you can select all users of type dialog from known "end user" user groups into an internal table (see function module BAPI_USER_GET_LIST) and then lock all users in the internal table (perhaps after explicitly deleting DDIC, SAP* and yourself from the internal table - just to be safe).

There is also a blog and some posts here with more information about BAPI's for user administration by

Julius