topic Re: Automatically delete users locked in Application Development and Automation Discussions

Automatically delete users locked

Former Member — Thu, 22 Feb 2007 11:38:02 GMT

Hi All,

Can you tell how to achieve automatic deletion of users who are locked after certain time period say X days. Let me know if any report is there for the same where users locked for X days are automatically deleted in R/3 system

Thanks in advance,

Shiva

Re: Automatically delete users locked

former_member74904 — Thu, 22 Feb 2007 12:06:01 GMT

Hi Siva,

I'm not sure if there's a standard report for this functionality in SAP, but a minor adaptation to RSUSR200 will most probably meet your requirements. I think report RSUSR006 (from the top of my head) can do the same, but the 200 version is more complete.

Once you have the appropriate selection in place for the report above you could add BAPI_USER_DELETE to your own report (copy of RSUSR200/006) in order for the selected users to be deleted.

Hope this helps a litlle...

Dimitri

Re: Automatically delete users locked

Wolfgang_Janzen — Thu, 22 Feb 2007 13:01:12 GMT

Well, in general I'd not recommend to delete user master records - but simply to set the account validity accordingly.

Reason: auditibility - you need to ensure that you are able to assign (historic) transaction data records to human users (which have performed the corresponding actions resulting in those transaction data records); the time period you need to keep those records archived depends on the type of data as well as on country-specific legal regulations.

If you delete a user master record and reassign the userID to another user you'll have much harder times to fulfill those legal requirements ...

Regards, Wolfgang

Re: Automatically delete users locked

Matt_Fraser — Thu, 22 Feb 2007 15:44:24 GMT

Siva,

I agree with Wolfgang; it's best not to delete the user master records, but to set an end-date in the validity period (simply locking them, while rendering them unusable, does not stop them from being counted in your annual license audit, whereas the audit will NOT count user masters that are beyond their validity period).

Rather than writing a custom BAPI to do this, you could use SU10, the "User Maintenance: Mass Changes" transaction. With SU10 you can select groups of users based on various criteria and then perform the same action (such as deletion, or setting validity end dates, etc) on all of them at once. To select all locked users, for instance, click on the Authorization data button, then in the Additional selection criteria section, check the box for Locked Users Only. This will give you a selection set of all locked users, which you can then edit, delete, unlock, etc. If you choose the edit the list of users, one of the things you can do is to set the Valid through date for them all at once.

Bear in mind that users might be locked for a number of reasons, and you may not want to invalidate or delete all locked users. For instance, by default, users will be locked after a certain number of incorrect logon attempts (bad passwords entered) in a row. While you might want to pay attention to when this happens, you don't necessarily want to delete the users! Likewise, you might have highly-powerful administrative accounts that you only use in emergencies, and the rest of the time keep them locked, or an account for SAP Support or consultants that again you only unlock when it's actually required.

In my organization, we do periodically run report RSUSR200 (mentioned earlier in this thread) in order to find users who have not logged on for a certain period of time, say six months or so. Then we go find out why those users aren't logging on -- have they left the company and we just weren't notified? If we can't determine the reason, we'll usually lock the account and then wait to see if the user complains. You can also get to this report via transaction SUIM, though I use it so often that I created a custom tcode (ZUSR200) to access it directly with my favorite variant, to save a few mouseclicks (it's good to be the sysadmin!).

If you really wanted to get fancy and truly automate this process (though I think a human eye looking it over is a good thing), you could probably devise some means of using the output of RSUSR200 as input to SU10 in a batch process.

--Matt Fraser

Message was edited by: Matt Fraser

Matt Fraser

Re: Automatically delete users locked

Wolfgang_Janzen — Thu, 22 Feb 2007 16:32:17 GMT

Maybe it's worth mentioning that as of SAP NetWeaver 2004s (aka "7.00") ABAP systems are able to restrict the lifetime of idle passwords - not only of "initial" ones (as of 6.20, after applying the patch of <a href="https://service.sap.com/sap/support/notes/450452">SAP Note 450452</a>) but also of "productive" ones - see <a href="https://service.sap.com/sap/support/notes/862989">SAP Note 862989</a>