SAP* user security

[Uppdeep_Mann]

Hi,

To secure SAP * user , parameter login/no_automatic_user_sapstar is set to 1.

Additionally,do i still need to delete its authorizations or delete user SAP* in all clients including client 000?

What can be consequence if I remove this user?

Thanks & Regards,

Uppdeep

[pau_torregrosa · Accepted solution]

Hi Uppdeep,

SAP recommendation is to set parameter login/no_automatic_user_sapstar to a value greater than 0, and create a user master record (SU01) for SAP* in all clients, with no authorizations. That is more secure than not having a user master record for SAP*, because as soon as you don't have a user master record, the only thing securing SAP* from missue is the parameter you mentioned. Having also a user master record with no authorizations adds extra security.

Regards,

Pau.

[Uppdeep_Mann · Accepted solution]

Thanks Pau for your answer.

There is one point mentioned in link at sap help : https://help.sap.com/doc/saphelp_nw70/7.0.31/en-US/4f/3eb3f249aa2eb5e10000000a42189c/content.htm?no_...

6. Deactivate all authorizations for SAP* in all clients except for those required by SAP License Administration (transaction SLICENSE)

Trying to understand that why one client in system should be exception.!!?

[pau_torregrosa · Accepted solution]

Hi Uppdeep,

Not sure, looks like there might be a scenario where you might need to delete or install a License Key, and using SAP* would be the only option to perform that action, so leaving SAP* with just SLICENSE authorizations would allow you to administer license keys in case it's needed.
Check SAP Note 917936, and the bellow link:

https://help.sap.com/saphelp_nwpi711/helpdata/en/db/4a8338d22aa947e10000009b38f8cf/content.htm?no_ca...

Hope that helps.

Regards,

-Pau