topic Re: Remove authorization for Tcode: ME21 and ME22 from certain users in Application Development and Automation Discussions

Remove authorization for Tcode: ME21 and ME22 from certain users

Former Member — Thu, 24 Nov 2011 21:57:34 GMT

Hi Guys,

I'm new to BASIS.

My requirement is to: Remove authorization to Tcodes ME21/ME22 from a list of users.

How do I acheive this? We run on SAP 4.0B version.

Hoping to get this resolved as soon as possible.

Thanks

SAPUser

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

former_member184701 — Thu, 24 Nov 2011 22:09:01 GMT

dear friend,

run SU01

goto Information-Information system

select node Roles-By Transaction Assignment

type ME21, ME22

execute report

see the roles displayed

then find user who have these roles (usually company uses z-roles copied from standard)

just highlight the role and hit user assignment (Cntrl-Shift-F9)

you see all users who have this role. that means they are able to run these transactions.

let's remove the role(s) we found.

open second session, run SU01 type one of the user , goto Roles tab and delete the particular role you found.

save user and test it (ask hem/her to log in sap and run ME21 and ME22). if needed adjust it again (may be another role to be deleted)

say, fix completely one user/test it and then do the same things for other. test them.

good luck!

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

Former Member — Thu, 24 Nov 2011 22:28:27 GMT

Thanks so much!

When I go in SU01-Information-Information system...it does not list down Roles.

What i have is:

1. User

2. Profiles

3. Authorization objs.

4. Authorizations.

5. Activity groups

6. Transactions

7. Comparisons

8. Where used lists

9. Change documents

Any further help??

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

former_member184701 — Thu, 24 Nov 2011 22:58:01 GMT

sorry my friend,

i drive sap ecc6.0 - the menu i see is different from yours...

look / check out EACH node form 1 to 9 searchnig for word ROLES

it must be there

regards,

p.s or try to run t-code S_BCE_68001420 directly (if it exists in your 4.0)

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

Former Member — Tue, 29 Nov 2011 22:14:54 GMT

The system wont let me run this Tcode as you've mentioned below, its says Transaction is unknown.

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

Former Member — Tue, 29 Nov 2011 22:18:50 GMT

Unfortunately, I dont find Node "Roles at all".

Instead, i can see Profiles..Could it be same as roles by any chance?

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

former_member184701 — Wed, 30 Nov 2011 23:18:08 GMT

dear friend,

please look a t item 6 (Transactions)

you need to explore it - please check out each function

regards,

p.s. do not be passive, all tools are available - just check them

use sap help as well:

http://help.sap.com/saphelp_40b/helpdata/en/52/6716f1439b11d1896f0000e8322d00/frameset.htm

there are nodes on the left - click on them and read

good luck!

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

Former Member — Wed, 30 Nov 2011 23:43:36 GMT

Based on the tcode: ME21, we have found out a activity group and this activity group has a list of profiles(through profile assignment) where the authorization object S_TCODE has value of ME21 & ME22 in it. these profiles are assigned to many other users as well.

I have a list of users for whom the access to Tcodes: ME21 & ME22 has to be taken off.

How do we proceed based on this data, is my question..

If anybody can help me out with it, it would be great.

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

former_member184701 — Thu, 01 Dec 2011 00:08:11 GMT

dear friend,

i do my apologies that we are still looking for your solution.

the problem is your 4.0B version which has a bit another conception then latest....i have ecc6.0 which is much easier to do...

my understanding is (and correct me) - you have a list of particular users who have access to ME21 and ME22.

and you need to remove this access.

from my point of view now you need to identify the profiles which contain these transactions and simply remove these profiles from users accounts.

please explore the node Profiles (now I am not using the word 'roles') and try to identify the function which search by auth. object or transaction...

regards,

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

Former Member — Thu, 01 Dec 2011 00:14:15 GMT

Thanks a lot for taking pains to help me find a solution for this.

Yes, i have a list of users who currently has access to ME21 and ME22 and in the future, we need to remove their authorization from these 2 Tcodes for this list of users.

We have found around 10 profiles now, which are assigned to these user master records which authorize them to access tcodes: ME21 AND ME22.

You mentioned, removing these profiles from the users.How do we do that? Sorry, for this basic question!

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

former_member184701 — Thu, 01 Dec 2011 00:21:43 GMT

what you could try now...

select just one user (which you will try to fix) which has access to ME21, ME22

run SU01, type this user name and hit Change (pencil)

go to Profiles tab and remove some profiles which (you suggest) have such access.

do BY ONE. remove one, save user.do login by this user. run ME21, ME22. check out - still access or not.

if still yes, come back to this user (SU01) restore that profile (which you removed) and remove the next one.

if NO (removed!) grab this profile - you will try it for other users

do the same step.

unfortunately I can't suggest more short and right way(( but try to find out it just such steps, i believ you will get the clear picture!

Re: Remove authorization for Tcode: ME21 and ME22 from certain users

Bernhard_SAP — Thu, 01 Dec 2011 11:54:53 GMT

Hi,

although asking basis questions is against the rules of engagement....

Do not delete the profile assignements, but delete the assignements of the activity-groups from the users.(mass provessing in SU10).

The automatic profile comparison will remove the assigned profiles then automatically.

SAP course ADM940 explains that in detail. Also you should follow the recommendation to study the online help for the basic information you require.

b.rgds, Bernhard

Thread locked