R_UC_TASK Consolidation Task Security

Hi,
I am building Security roles to restrict access to BCS Consolidation Group(Characterstic 1) and Task Fields via BCS Authorization Object R_UC_TASK.
Since I have 20 Consolidation Groups and 6 different Tasks, do I need to create 20*6 = 120 roles to cover security roles for each combination or is there a way around to this situation ?
Please share your experience.
Cheers,
AJ

Can you please elaborate in detail ?
Regards,
Ajay

Similar Messages

Unable to Kill the Consolidation task for HFM application

User is unable to kill the Consolidation task in HFM application. Consolidation process which usually takes 2 mins has been showing status as running @79% since 4-6 hrs. User ID is has the provisioning manager, lock Data and unlock data provisions in Shared Services. The stop task button in the Running Tasks list is not enabled . Our Support team has advanced user access which is not also able to stop the task. Please note Admin access is restricted and not allowed for such tasks.

I would check the HFM Log to see if you find anything referring to locked / blocked records.
If your HFM app is killed in the middle of consolidating or performing other activities that requires it to 'lock' a segment of memory in the database, that 'lock' is still held on those data points when the application restarts.
If you then try to perform another consolidation and it hits one of those locked data points, it will sit there for a very long amount of time waiting for the 'lock' to clear.
I forget the exact error message that you will find in the log AND I forget the timeout period; however, it sucks having to wait through that.
The other possibility that comes to mind is that the consolidation really aborted and the status didn't update. (once again check the logs)
Charles

Activity / Task security

I was surprised to find out that any user can complete or cancel a task regardless of the security privileges set.
I have the activity entity set to read access across the organization, and all other privileges restricted to User.
If user A creates a task and assigns it to User B, I would expect ONLY user B can complete the task, in fact it seems that anyone can complete the task, if they can see it. Am I missing something here?
CRM 2013 / SP1 UR2

Hi Marcus,
Check the write privilege for the users on activity. If this set to organisation or BU, this is possible to have the behaviour you are mentioning. If you want only user B to change this, reduce the rights to user and others
will not be able to change this. This can be checked under Settings-> Administration -> Security Roles and open the relevant role. Then select the Core Entities tab and check the first one which is activity.
Hope this helps.
Minal Dahiya
blog : http://minaldahiya.blogspot.com.au/
If this post answers your question, please click "Mark As Answer" on the post and "Vote as Helpful"

Authorizations for tasks (R_UC_TASK) / Best Practice SEM-BCS authorization

Dear Experts,
I am quite new to authorizations and in particular to SEM-BCS authorization. So I would be happy if you could help me with the following requirement:
We have to setup an authorization concepts for SEM-BCS. Among others we want to setup authorizations for consolidations tasks using authorization object R_UC_TASK. With this authorization object certain tasks can be restricted to certain characteristic values u2013 e.g. for a certain consolidation group or a certain consolidation unit. We have defined a role each for certain consolidation tasks. These roles are not restricted to any characteristic value yet. We have for instance a role u201Cregional controlleru201D who is allowed to perform certain BCS tasks on a regional level (consolidation unit level). This would mean that we would have to create the role u201Cregional controlleru201D for all consolidation units u2013 see example below:
Role 1: Regional Controller u2013 Cons. Unit 1000
Role 2: Regional Controller u2013 Cons. Unit 1100
Role 3: Regional Controller u2013 Cons. Unit 1200
Role n: Regional Controller u2013 Cons. Unit n
We have more than 400 consolidation units. So this would require a high effort. Is there instead a possibility of creating one role based on authorization object R_UC_TASK which just defines which activities can be performed (without restricting access to a certain consolidation unit). , and using second role which defines the consolidation unit access? u2013 see example below:
A
Role: Regional Controller
Role: Cons Unit 1000
B
Role: Regional Controller
Role: Cons Unit 1100
C
Role: Regional Controller
Role: Cons Unit 1200
In this case we only would have to maintain one role u201CRegional Controlleru201D and we only would have to assign the restriction for the consolidation unit. How could this be realized? Or do you have any other ideas to solve this requirement in a simple way?
Moreover I would be happy if you could tell me where I could find best practice scenarios for SEM-BCS authorizations.
Thanks a lot in advance!
Best regards
Marco

Hello Marco,
you can enter a master role in the description tab of a role. All fields populated via program PFCG_ORGFIELD_CREATE can be maintained in the role. All other fields will be taken from the master role. So you only need to populate the field for unit with the program.
Good luck
Harry

Consolidation blocked while security file is loaded

Hello,
we have just migrated from HFM 9.2.0.3 to 11.1.1.3 and have found a strange behaviour when we load security file.
It seems that a security load can not run at the same time as a consolidation task or dataload.
It was not the case in 9.2, security file loading had no impact on other tasks.
Did you encounter that behaviour on your side ? Is it something normal or are there any setting to bypass this ?

Actions that change the system, including security, rules, metadata, or list file loads, need to alter the cached information on all application servers. When this happens HFM has to log out all users, and therefore HFM will wait for currently running consolidations to complete before it can make such a system change. The only thing you can do is to let users know in advance that during a specific timeframe you will be updating the settings. Otherwise what you experience is normal.
--Chris

Best practice tast profile security in BPC

Hi,
I'm in the middle of a BPC NW 7.5 implementation project and need to set up the task profiles in BPC. I'm looking for a clear description of the different tasks - does anyone now if this is available?
Furthermore I'm interested in Best Practice experiences with task security in BPC - any input on this matter?
Thanks,
Lars

Hi,
You can extract the information from the Security Guide located on Service MarketPlace at:
https://websmp202.sap-ag.de/securityguide
follow the path to "SAP BusinessObjects (formerly, SAP Business User)" and select
SAP BPC 7.0, version for SAP NetWeaver Security Guide
hope it helps...
regards,
Raju

Access Denied Error For Shared Folder with Win Server 2008R2 Task Manager Scheduled Task

Hi,
I have scheduled a Task with the Task scheduler. It invokes an .EXE file after every 5 min.
The application is supposed to access some files lying on a different Server's shared path, process them and move them across folders on the Shared path only.
Problem: When the .EXE gets executed from the Task scheduler, I am getting "Access Denied to the Shared path" error. I have already given Full Control to Everyone as well as to the Account with which the Task has been configured with.
Another important point to note is, if I run the .EXE manually, the solution is able is able to do everything intended; I don't get any Access Denied error.
Kindly help me with what needs to be done in order that this issue is resolved. This is really urgent for me.
Thanks a lot in advance..
AC

Hello Alex,
first of all, make sure your task was correctly create: How to Create Advanced Tasks with the Task
Scheduler.
Please, read these:
TechNet Library Task Security Context
TechNet Forums post How
does "Run with the highest privileges" really work in Task Scheduler ? - Look at the answer "...When you want to run a program with admin rights from a standard user account, you have to select "run whether the user is logged
on or not" and select a user which is member of the admingroup."
TechNet Forums post
Log on as batch job right (written on previous post)
serverfault Task Scheduler is not executing the program
serverfault
unable to schedule a task (access denied)
UAC: Do you receive the User Account Control "Windows need your permission to continue" message to approve the scheduled application ?
If yes, maybe "Run with highest privileges" option will not take precedence of the UAC. While the Admin Approval Mode for built-in Administrator account is enabled, UAC will still ask for approval according to the settings on the Behavior
of elevation to prompt for the administrators. Check whether the "User Account Control: Admin Approval Mode for built-in Administrator account" is enabled. If yes, disable it or change the setting on "User Account Control: Behavior
of elevation to prompt for the administrators" to elevate without prompting.
Local Computer Policy ---> Computer Configuration ---> Windows Settings ---> Security Settings ---> Local policies ---> Security Options (source: Task
Scheduler "run with highest privileges": does not work on Windows Server 2008 ?)
Bye,
Luca
Disclaimer: This posting is provided AS IS with no warranties or guarantees, and confers no rights. Whenever you see a helpful reply, click on [Vote As Help] and click on [Mark As Answer] if a post answers your question.

Consolidation Frequency

Due to business reasons consolidation is required on quarterly basis only. Added the 0CALQUARTER infoobject for this purpose to BCS cube. All BCS task need to be executed on quarterly basis only.
Now what is the role to assigned to this infoobject, since our consolidation task has to be executed using this infoobject. The role period is already assigned to month.
Appreciate to share your experience/thoughts,

Hi Eugene,
Thanks for the details. We already have the derivation in BI cube to derive the calquarter details.
But since we have the 0CALQUARTER in the BCS totals cube and need to assign the role in 'Cons area'.
What is the role to assign? The monthly period is already assigned the role?
Should we give the role of subassignment to 0calquarter?.
Since all our consolidation process is based on quarter as frequency, shall we assign the period role to quarter and give the subassignment to month? Does it work this way?
Please let me know your opinion on role.
Edited by: Gokul on Jun 24, 2008 6:07 AM

BUSINESS CONSOLIDATION SYSTEM

Hi Gurus...
Could you please send any document related to BCS (BUSINESS CONSOLIDATION SYSTEM )

HI. Sudheer
Business Consolidation (SEM-BCS)
The following sections contain the documentation on the BW-based component Business Consolidation.
The documentation on the R/3-based component Business Consolidation is located elsewhere. This documentation can be accessed, for example, by calling up Application Help in your R/3-based Business Consolidation system.
Purpose
You can use the SEM component Business Consolidation (Consolidation) to determine the resources of a group (or a similar enterprise or organizational unit), the claims by others to those resources, and the changes to those resources. Consolidation also provides the means for internal and external enterprise reporting.
You can consolidate on the basis of customer-defined consolidation units. Consolidation units can represent, for example, companies, plants, business areas, profit centers, and cost centers. You can also portray matrix organizations (for example, using a combination of companies and profit centers).
You can standardize the financial data reported by individual consolidation units to adhere to the accounting and valuation standards of the group. You then translate the standardized financial data from the various local currencies into the group currencies. Finally, you can eliminate the effects of group-internal relationships (for example, from interunit trade and services). Thus, you calculate the consolidated financial statements as if the group were a single entity.
You can use the analysis functions of SAP Strategic Enterprise Management (SEM) and those of SAP Business Information Warehouse (BW) to analyze and report on your consolidated financial statement data.
Integration
The Consolidation component provides functions to collect master data and individual financial statement data from data files from non-SAP systems as well as SAP systems.
All SEM components are based on BW. These are:
Business Consolidation (SEM-BCS)
Business Planning and Simulation (SEM-BPS)
Corporate Performance Monitor (SEM-CPM)
Stakeholder Relationship Management (SEM-SRM)
Business Information Collection (SEM-BIC)
The data processed by Consolidation is written to the BW system. There you can share the data between Consolidation and the other SEM components. For example, you can:
Collect SEM-BPS planning data for use as reported financial data in consolidation
Use consolidated actual data as the basis for further planning in SEM-BPS.
Features
Versions
You can use versions to execute parallel consolidations with different categories of data (for example, actual data, planning data, forecasting data), using different accounting principles (for example, US GAAP, IAS, German HGB), using different valuations, and/or for simulations.
Hierarchies
You can create hierarchies for almost all characteristics (for example, consolidation units and financial statement items), where some hierarchies have special, consolidation-specific properties.
Consolidation Charts of Accounts
The component enables you to use different charts of accounts for consolidation. For example, this allows you to generate several consolidated financial statements in parallel to accommodate different accounting principles.
Collection and Standardization of Reported Data
You can use online data entry or flexible upload to collect individual financial statement data and other consolidation-relevant data into the consolidation system.
You can post manual entries, for example, to standardize the reported data to meet the accounting and valuation requirements of the group.
Consolidation Tasks
You can automatically execute the following consolidation tasks:
Currency translation (which translates the financial data into the currency of the consolidation group)
Validation
Interunit eliminations (for example, for payables and receivables, revenue and expense, or investment income)
Elimination of interunit profit/loss in inventory
Consolidation of investments
Reclassification
Allocation
Balance carryforward
The automated postings are controlled by the task settings you define once beforehand in Customizing.
Reporting
After performing the consolidation tasks, you can use BW reports to analyze your data. SAP provides pre-defined BW business content (InfoCubes, queries, etc.) for this purpose.
You can use XBRL to create individual or consolidated financial statements.
Execution and Monitoring of the Consolidation Process
You use the consolidation monitor to execute the consolidation tasks and to monitor the entire consolidation process.
Constraints
The automated execution of the elimination of IU profit/loss in transferred assets is presently not available.
The automated execution of consolidation of investments presently only covers the purchase method with the activities first consolidation and subsequent consolidation.
You can use manual posting to perform the consolidation tasks that are not yet automated to meet the statutory requirements for creating consolidated financial statements.
http://help.sap.com/saphelp_sem320bw/helpdata/en/62/f7e73ac6e7ec28e10000000a114084/frameset.htm

Issue with Task Scheduler on win 2012 R2

Hi All,
I am running a powershell script on windows server 2012 R2. It runs fine when i run it with powershell.
And when i create task and choose option " Run only when the user is logged in" it works fine.
But the issue is when i select "Run whether is the user is logged in or not" And with highest privilege it doesn't work.
Tried solution:
created a folder (or two on a 64bit-windows):
(32Bit, always)
C:\Windows\System32\config\systemprofile\Dektop
(64Bit)
C:\Windows\SysWOW64\config\systemprofile\Desktop
as the powershell creates a excel and saves it in the some folder.
not sure what is causing it.
Any help on this will be appreciated.

Hi,
From the
Task Security Context article, we can get following description.
You can specify that a task should run even if the account under which the task is scheduled to run is
not logged on when the task is triggered. To do this, select the radio button labeled Run whether user is logged on or not. If this radio button is selected, tasks will not run interactively. To make a task run interactively, select the Run only when user
is logged on radio button.
Just a confirmation, did your PowerShell script involve any operation of mapped drive? If involved, please
use the full UNC path and monitor the result. Please refer to following similar thread and check if can help you.
Task
Scheduler Problem (run whether user is logged on or not)
Meanwhile, please open this scheduled task’s Properties and navigate to History tab, then check if find some
relevant events.
View Task Properties and History
If any update, please feel free to let us know.
Hope this helps.
Best regards,
Justin Gu

Cannot find any domain in the add new user screen in BPC NW platform

Hi,
While adding new users in BPC NW, I can't see any value in the Avaialable domains dropdown. Hence I am unable to add any users. I am not sure if I have missed any any step during BPC installation.
Can anyone please help and suggest the cause of this error and also suggest the remedial action.
Thanks...

The BPC Installation guide says:
Make sure that the server is configured on the domain or a trusted domain by going to My
Computer --> Properties --> Computer Name --> Change. Make sure the correct domain is specified.
Also...
In this step, you define the .NET service user that is needed to log on to ApShell and run Server
Manager.
Note
This user must be a Windows domain user that installs the .NET server component, is a local
administrator on the machine, has initial access to ApShell (no task security is checked for this
user), is able to browse the Active Directory, and is used to log on to Server Manager. It can be
any user that exists on the domain on which the .NET server is installed. You can verify the
settings in table UJA_SVR_DEFAULT.
a) Stop the IIS and SAP Business Planning and Consolidation instances using the stoposoft.bat
file. For more information, see Tips [page 27].
b) Go to transaction SE38 and run program UJA3_WRITE_SYS_USERS.
c) Assign a single domain user to all user types:
BPC SysAdminUser Domain\<user name>
BPC AdminUser Domain\<user name>
BPC User Domain\<user name>
Also...
The user who creates the initial application set must be the domain user specified in the sysadmin
field of the UJA3_WRITE_SYS_USERS program.
Also...
On the .NET server, check the C:\WINDOWS\system32\drivers\etc\hosts file to ensure that a fully qualified domain
and an IP resolution exists.
Thanks and best regards,
[Jeffrey Holdeman|http://wiki.sdn.sap.com/wiki/display/profile/Jeffrey+Holdeman]
SAP BusinessObjects
Enterprise Performance Management
Regional Implementation Group

Previews does not actually "replace" if document with same name is open.

I am using FMP 9.0--When I "save records as PDF"....
IF I have a pdf open in Preview with the same name,
Preview offers to "save as",
tells me I have one w/the same name and asks if I want to replace...
I say YES....and
ONLY the older version is saved.
(I happen to be troubleshooting a script so the name is "toss.pdf"--several times. If the previous toss.pdf is not open it works as anticipated. Otherwise I do not actually "replace" the older one as preview leads me to believe.)
I have not tried this on a non-intel machine, so I don't know if it's Intel specific--or if it's just me...:-).
Not a huge problem, but it seems that if it is an issue it could use a fix..

Hi,
Thank you for posting in Windows Server Forum.
By default it will automatically update the RemoteApp and Desktop Connections but if in any particular case it’s not happening then for a try you can restart the server and check the result again. In addition you can try running below command and check
the result.
Start-Process rundll32 -ArgumentList "tsworkspace,TaskUpdateWorkspaces2
More information:
Powershell to update "RemoteApp and Desktop Connections"
If a task is registered using the Administrators group for the security context of the task, then you must also make sure the Run with highest privileges check box is checked if you want to run the task. Please check “Task
Security Context” for more details.
Hope it helps!
Thanks,
Dharmesh

BCS Program Termination - Database Inconsistency

We are using SEM-BW 4.0, SAP-BW 3.5, running BCS. We are trying to change the Breakdown Category of an FS Item going forward. The system allows to change and save the Breakdown Category as needed, but when we attempt to post a manual entry or run the data stream or any tasks, the BCS system crashes with the following error:
Transaction: UCWB_INT
Program: CL_UC_SELCOND_FACTORY in IF_UC_CUST_FACTORY~GET_INSTANCE_BY_GUID
The main program was UCUWB000
There is a composite note 859500 that explains GUID errors and how to prevent them from occurring in the future. We have either implemented all of the notes mentioned (via Support Packs) or they do not pertain to our release. However, this problem continues to happen. SAP indicates that even though these notes are applied, the database will be inconsistent and will need intervention from SAP to get it fixed. Since this has been occurring in our test system, we have been able to restore the system from backup. We have also seen note 805360 - Change of Breakdown Categories.
Has anybody else run into this issue, and if so, how did you get it resolved? We cannot let this happen in our production environment.
Any assistance is appreciated.

We are having the same issue when we try to execute few consolidation tasks. We have sent a message to SAP support and they are looking into the same.
We are not able to understand what GUI inconsistency means

Does refreshing a report that includes Scope and Entity require elevated rights / permissions?

This relates to the following thread:
Why does refreshing a report in the EPM Add-In need to edit the Ownership Manager?
Since I've received no responses on the above thread, I thought I might approach this from a different angle.
If we have a report that includes both Scope and Entity, in SAP BPC 10 NW (801 SP03) / EPM Add-In 10.0 SP 16 Patch 1, does this require a user to have elevated permissions in order to refresh the report? I ask because I have users who have rights to view reports, but they error out when they try to refresh a report's data, only where Scope and Entity are used in the report. The tasks that error are:
P0081
Run Consolidation Tasks
P0082
View Ownership Manager
P0083
Edit Ownership Manager
I do not understand why any of these should even be called by refreshing the report, as the user is simply "viewing" data that already exists in the environment.
Can someone please shed some light on this or point me in the direction of how I can go about resolving this issue?
Your help is greatly appreciated.
Jeff

Hi
I am facing the same issue despiste the elevated app permission as per
https://msdn.microsoft.com/en-us/library/office/jj822159.aspx?f=255&MSPPError=-2147217396
I still had the error 401
the solution for me was
Under list settings -> advanced settings update the Create and Edit access settings from "Create and edit all items"
the add the user the right to add only ( no edit , no delete) .
Eric Caron

Profit Center Group Organization Change - Effective for Prior Periods

Hi Experts,
A client wants to perform a horizontal organization change (profit centers) and see the effects retroactively to the prior periods. To achieve this, they plan to re-execute the consolidation tasks going back two to three years once the org change is made, so that they have comparative financial statements that take into account the change. The requirement is to re-post the group level postings to the updated profit center group after the change. For example, Italy related postings would occur under the group Central Europe instead of Western Europe as before. All the group level postings previously booked to Western Europe would now need to recorded under Central Europe going back prior periods.
Does anyone have any ideas as to how to meet the requirement without re-consolidating?
One option was the restatement feature but based on the SAP help description of the monitor required, it does not take into account consolidated postings, only uploaded PL00-10 data and translation.
Another option is to copy the version but then the results is in another version rather than the original 'actual' "100" version.
Any ideas would be appreciated.
Thanks
Eyal Feiler

Eyal,
I know of no other way to accomplish this than to re-execute the consolidation for the prior periods after the hierarchy has been changed.
I have used the restatement feature and like you have found it very limited.
The copy to another version would only work if you copied the existing data to the new version before re-executing the consolidation. The the version 100 can be re-consolidated for the previous periods and the existing reports do not have to be changed for a new version.
However, with the copy, it is important to set the cons group and cons unit hierarchies to be version dependent so the changes are only good for the version that is to be re-consolidated for previous periods. This allows you to report on the data before the change where the logic will read the old, unchanged version of the hierarchy.
Dan

R_UC_TASK Consolidation Task Security

Similar Messages

Maybe you are looking for