User Comparison

[Former Member]

Hello All,

Can anybody please explain the significance of User Comparison in PFCG Transaction, while creating a user and assigning roles.

Thanks,

Abhishek

[Former Member]

Plenty of info here:

http://help.sap.com/saphelp_bw21c/helpdata/en/52/6711ec439b11d1896f0000e8322d00/content.htm

Basically by doing a user compare (however you run it) you completely reconciles the roles and associated profiles with the user/s.

[Former Member]

PFCG does user master record comparison.

For example,

If u add tcode in a role, u have to do user comparision to reflect this changes to users.

Yellow light indicates user master record not compared properly.

Please always Make sure that green light should appear in PFCG.

<removed_by_moderator>

Edited by: Julius Bussche on Jun 12, 2008 7:15 PM

[Former Member]

User Comparison will reconcile the PROFILES within a user's account and make the necessary changes. This is especially true when you've assigned specific Valid-To dates for the roles on an account. If the Valid-To (expiry) date of a role has passed, the User Comparison will REMOVE the profile/role from that account.

As mentioned above, if you see a red button in PFCG this means that a User Comparison should be executed to help reconcile the profiles for the users. You can also see this in SU01 if a specific role has a red button.

As a suggestion, SAP recommends running the report PFCG_TIME_DEPENDENCY once a day to perform a User Comparison and help 'clean up' the User Master Record for your system.

You can also do it manually using PFUD.

Hope this helps

Nigel

[Former Member]

>

 This is especially true when you've assigned specific Valid-To dates for the roles on an account.  If the Valid-To (expiry) date of a role has passed, the User Comparison will REMOVE the profile/role from that account.

Hi Nigel

In ECC6 at least, the roles will remain if time delimited & only the profiles are pulled. I'm pretty sure in previous versions it would remove both which makes more sense to me (we still have change logs we can use)

[Bernhard_SAP]

Hi Alex,

.....

I'm pretty sure in previous versions it would remove both which makes more sense to me (we still have change logs we can use)

.....

Also in previous versions (3.1I,45B,46C,...) only the profiles are removed, if the role-validity expired.

One cause is, that in those old versions there were no change logs for role assignements. So it was possible only to have a look into SU01 to see, if a role was assigned once to a user in the past.(as long nobody removed that expired assignement )

brgds, Bernhard

[Former Member]

Hi Bernhard,

Thanks for clarifying that

Cheers

Alex