Application Development and Automation Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
SAP* is the superuser in the SAP R/3 System. This is the only user in R/3 system that does not require a user-master record, as it is defined in the system-coding (i.e., it is hard-coded).
The default password for this user could be either PASS or 06071992. But since this is password is very widely known, this user can be misused and therefore a user-master record is specifically created in all the clients of an SAP R/3 system for this user-ID. After this is done, the hard-coding will be over-ridden by the user-master record.
It is also recommended that all the autohorizations for this user be revoked immediately following certain primary administation tasks for the SAP Authorization. Moreover, SAP recommends never to use SAP* as the superuser. Instead a new user-ID should be created with the profile SAP_ALL for that purpose.
check out reports RSUSR0*. I don't have a system at hand, but there should only be two hits or so.
One of them lists users with critical authorizations and reports obvious security holes. Among others, SAP* with default password will be reported if it has the default password in any client of the instance.
Bluesky
