I am wondering how to keep users from logging on to R/3 when the system is being maintainted.
Does anyone know the easy way to do this except network related configurations such as blocking ports?
You should be able to restrict users from logging on, with command 'tp locksys <SID>'.
This command restricts users from logging in, but existing logged on users will not be affected, unless they logged out then they will not be able to login again. You use command 'tp unlocksys <SID>' to unlock. SAP* and DDIC users can still logon at all times when this command is run.
When you run 'tp locksys <SID>' it take some time until locksys becomes effective (buffer synchronisation), this is dependent on the parameter 'rdisp/bufreftime' value.
After you run 'tp locksys', an entry in table TRPUT is created. Normally this table is empty. The TRPUT entry contains the area and message number of a T100 message. The content of this message is displayed when a user tries to logon, as far as I know the default message is "Upgrade still running. Logon not possible".
I hope this information helps.