Alerts in GRC 10 for FF Admin assignment

Hi Experts,
Can we have an alert notification when an FF ID is assigned to Firefighter as an Administrator mode (Not Via Workflow)
This issues is related to the compliance, any admin can assign a high risk FF ID to any User.
We have only one option to have some change logs and this is a manual process.
FF IDs are very high/critical risk involved.
so kindly suggest on this.
Thanks,
Sriram

Hi Neeraj,
Your are correct.. But here the GRC Administrators will have end to end access to do all the activities.
The log in notification to the owner/controller is an second level control. But is there any possibility to have this at first level i.e, admin assigning the FF ID.
We are aware that such functionality is not available from GRC standard product
Do you have any idea to do this via coding to have some custom notifications outside of MSMP.
Appreciate your suggestion.
Thanks,
Sriram

Similar Messages

Error while activationg BI content for BI admin cockoit for data sources

Hi all,
I am doing BI content activation for BI admin cockpit, from SPRO -- Activation of BI content of BI admin cockpit , i ran the activation but it got failed. The error message says:
DataSource 0TCTBWOBJCT_ATTR from source system BWQCLNT500 could not be activated
This error is coming for data sources :0TCTPRCSVAR_ATTR, 0TCTBWOBJCT_TEXT, 0TCTPRCSVAR_TEXT and 0TCTBWOBJCT_ATTR.
I have applied the sap note 1110642 , 1110641 . also ran the program RSSM_SHIPDVERS_CLEANUP but did not able to find these info packages for this data spurces:
0PAK_8K20VQGEBZRQXUE2PKWS90ZO8
0PAK_934GEKKIBBDKPVMVDJHVNPIMV
0PAK_99MQNPZISKNSNWKT9HF2CWPLK
0PAK_BFYU3MMMU2T2WOI50MXHCEH07
I also tried activating these data sources manually in BI content one by one , there alaso iam getting error :
Data source can not be actvatedm, troied in RSDS also by replicating but says there also that this data source does not exist in source system.
Due to this data sources iam geting problem inmy process chain..
PLease help .Pts wil be assigned.
Thanks and Regards.
Akash

First of all Rather than using SPRO to install Admin Cockpit, its better to install it from Business Content, else many of your existing InfoObjects would get overwritten and you would require to revert them back.
2ndly, check if these DataSources are available in your source system. While installing from Business Content, the system prompts to log in to source system interactively and would install the DataSources in teh source system if they are not there already.
Also check what versions are your Source Systems on. Older versions may not have the DataSources while the new concept of Admin Cockpit is available in BI7.0 which goes well with ECC.
Regards
Anujit Ghosh

Mail Alert to Managing Director for every transaction for customer & vendor

Dear Gurus,
Please let me know how & where to do setting for mail alert to Managing Director for every transaction for customer & vendor,
Like for Customer: Sales Order, PGI, Invoice, Payment receipt................
for Vendor: Purchase Order, GR, Miro, Outgoing Payment for Vendor,
Thanks in advance,
Sai

Hi Sai
If you want to set the mail alert to Managing Director for every transaction for customer & vendor Like for Customer Sales Order, PGI, Invoice , PO then maintain at all levels output type and at all levels for those output types assign the authorization as Managing Director
But for what purpose you want to assign the authorization member at all levels, what is your requirement?
Regards
Srinath

GRC 10 EAM - Unable to assign Firefighter roles to owners

Greetings SAP gurus,
I am currently on a new GRC 10 installation and having issues with the Emergency Access Management (EAM) component previously known as FireFighter or SPM. Note: We are trying to implement the Firefighter ''Role-Based" Approach.
Issue: We are unable to assign EAM roles to owners within NWBC. Click on 'Assign owners to Firefigher ID's and provision Firefighter ID's to firefighters' via the Access Management Tab within NWBC, option Superuser Assignment. Click on Assign. We are able to find the owners, but when I search for roles to assign, I get the error, 'No records found for the search criteria entered''.
We are on SP7.
Items completed:
1) All post installation tasks were completed correctly, i.e. BC sets activated, connector groups created and working.
2) EAM roles created on target system and imported via BRM.
3) EAM role properties edited for "Firefighting' usage in BRM, role owners defined, functional areas defined, business process and sub process areas defined.
4) Access control owners (i.e. role owners and controllers) defined.
5) The ID being used for configuration is currently assigned all GRC_NWBC roles available.
6) The connector groups are working fine and we are using for the Access risk Analysis component which is working fine.
7) The post EAM configuration steps has been completed.
Has anyone else experienced a similar issue? I look forward to your responses.
Rgds,
Prevlin Moodley

Hello Prevlin,
Are you using a FF role owner for the assignment. This might be helpful:
[Note 1289579 - Firefighter Owner additional authorization for Role based FF|https://service.sap.com/sap/support/notes/1289579]
Cheers,
Diego.

Basic configuration in GRC 10 for portals

Hi Gurus,
Could you please tell me the basic configuration details in GRC 10 for portals.
Thanks,
Mukesh

Hi Mukesh,
You can refer to https://websmp230.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/sno/ui_entry/entry.htm?param=69765F6D6F64653D3030312669765F7361…
However there is no such guide on Portal integration with GRC, you might need to follow below steps:
1- Create one HTTP type RFC connection between GRC and Portal system.
2- Create System Alias in portal system for GRC system
3- Deploy the GRC Portal content in Portal system
5-Portal content comes with 5 work-sets and one security role.You can assign the portal role that comes with the Portal content to user in Portal and also GRC roles to the same user in GRC system.
Hope this helps.
Regards,
Ameet

New IR's not appearing in Views for non-admins

We are in pre-production testing for SM 2012 SP1. We only have a few user roles beside the built in roles. We have a 'standard' group
which has access to just about everything except for sensitive items relating to user termination, legal, etc. We have a group which can see those sensitive items, and then we the built in administrators. <o:p></o:p>
When non-admins create an IR or SR, it sometimes takes up to 5 minutes for the item to show up a custom “all open incidents”
view, or in a custom “my incidents” view. In a few isolated cases, the work item did not appear for over an hour. However, admins can see all of these work items immediately in any view that should, by criteria, be displaying it.<o:p></o:p>
What would cause a work item to display immediately in all appropriate views for admins, but not for non-admins?<o:p></o:p>

Sorry for the delay in updating. Our management team got very frustrated with the performance and nearly killed the whole project. I got them to give SM another chance with R2, hoping that some of issues would be resolved. This issue was
not resolved.
So, I have continued testing. I cleaned up our Queues, so we only have 4 now in the Queues list. When I open the properties of the our custom user role, the Queue section displays our 4 queues, plus one called Work Item Group from the System
Work Item Library. I started with selecting just 1 Incident queue, for this user role. I created a new IR as this user, and it took nearly 15 minutes for the IR to appear in the view.
I then modified the user role and selected the "All work items can be accessed" radio button. I created another IR and it appeared in the view immediately. Now, this is where it gets interesting. I went back to the user role and set it
back to display a single queue, and the IR disappeared from the view. It didn't appear again for another 10 minutes.
The queue that is this IR should be assigned to is quite simple. Right now, I want it to display all incidents. It is not looking at an advanced class, just incident. Initially, I did not upt any criteria on it at all. I then tried
setting it to just Active Incidents, and still the IR's takes 10-15 minutes to appear.
I still don't understand what an aggressive queue is. Does my queue sound 'aggressive?' The view is looking at Incident (typical), not advanced. I don't see any obvious problems in the Workflow Status section of the Admin pane. What
should I be looking for next? I need to have the ability to filter queues by user roles, but it will cripple productivity if new IRs do not appear for 10-15 minutes.

OBIEE administartion Login is failing for Non Admin Group User.

Hi,
I have created one user for testing and assigned given access to some groups other than Administrators. When i am trying to login in Administration tool getting error message as "Logon Failed". I am able to access the Presentation using the same login and also able to create answers.
When i assign the administrators group to same user the login happened successfully.
I am just wondering, in order to access the Administration tool, the user should be part of administrators group or i am missing some steps.
Thanks

As the name suggests Administration tool is for administrators.So if you trust a user to access the Admin tool then you supply the user with the Admin Password.

Alert-LOG Db Growth for BizTalkMgmtDb2010

Can any one please suggest what should be Microsoft recommended Default settings for optimizing BizTalkMgmtDb2010?
We used MBV report & below is the details of alert & resolution as per MVB report--
Alert-LOG Db Growth for BizTalkMgmtDb2010
Resolotion as per MVB-Not recomended to use percentage (Current =10%,Def=10%) - Recommended for this Db=10240 KB ?!

Both way it will work ,generally SQL server Admin gives auto growth of SQL server files (MDF LDF) on percentage basis or keep it default at 10 % growth .
Now coming to Biz Talk ,as BizTalk databases are transactional ,Microsoft recommend to have a auto growth fixed like db growth =10240
Hope this answer your question
Thanks
Abhishek

Recommend some books for SAP admin on iSeries.

Experts:
I only have UNIX/NT/basis background but now assign to handle iSeries based SAP systems.
To get around, would you please recommend some books for SAP admin on iSeries.
Thanks a lot!

Hi Linda
You can check the below links if they are applicable for you..
http://www.redbooks.ibm.com/redbooks/pdfs/sg244672.pdf
http://www.redbooks.ibm.com/redbooks/pdfs/sg245200.pdf
http://www.4soi.de/iSeries-Docu.php
Best Regards
Anindya

Unable to install "Mavericks" as it asks for my 'Admin Password" and it does not work. Have not used it since I got my iMac in 2008. First upgrade to do so. Any solutions please?

I have a 2008 iMac which had Leopard initially and I have upgraded to each new OS without a hitch. I downloaded "Mavericks" and began the install, it asked me for my "Admin Password" which I have never ever used since I set the Mac up, I have it safely tucked away so entered it, it rejected it each time. Am sort of lost now, as if my "Admin P/W" does not work here can I go from here?
I have seen many others with this problem but so far most of the solutions seem to be for the "log in" or "User" password not the Admin one.
I am running Mountain Lion successfully.
I have my original disks as supplied and also a Snow Leopard install disk.
I have seen some info about fixing this via Lion Recovery partition which I must have due to using Mt Lion.
How can I repair this situation.
Thank you to all those who respond.

Thanks for your reply.
I have visited both the sites you listed but it seems to me that the solutions mentioned are to fix the User or log in p/w's.They do not seem to refer to the admin one again.
I understand about it being just like other user accts but the fixes do not really refer to it only the above two.
I have no problem booting up my Mac, I do not use a log in p/w so my problem is with the Admin p/w that was set up back in 2008. This is what I need to reset etc.
I am quite confused over these pw's as to just what is what and I need to make sure I understand all before I get into deeper trouble following these links.
This Admin p/w that was set up has never been used and is the only p/w I have except for my Apple ID. All previous upgrades only required my user name log in which has no p/w set up.
I hope you can follow me here butI have read so much on this it is becoming very confusing about whcih p/w's are what.

How do I become a Creative Cloud for Teams admin?

I am attempting to use the Creative Cloud Packager to ease the deployment of InDesign for two users, but I get error message "Your Adobe ID is not listed as an Admin for Creative Cloud for Team or Enterprise" when I attempt to login. How do I become a Creative Cloud for Teams admin?

Hi russmccabe333,
Please follow the steps mentioned in the kb: http://helpx.adobe.com/x-productkb/policy-pricing/creative-cloud-teams---customer.html#id_ 61014 to add yourself in the list of Team Admin.
Regards,
Romit Sinha

How to allow access to winrs for non-admin user?

I have Windows Server 2012 (and Server 2008, but it is next priority) to monitor it using txwinrm. txwinrm library internally is using WinRS protocol. I have to monitor it using least privileged user, but don't know how to configure access for him.
All I managed to do - is to configure remote Powershell session for my user, but it's look like that winrs and powershell sessions have different security descriptors:
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential Administrator $pwd) -ScriptBlock { 2 + 2}
# gives 4
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential lpu1 $pwd) -ScriptBlock { 2 + 2}
# gives 4
winrs -r:192.168.173.206 -u:Administrator -p:$pwd 'powershell -command "2+2"'
# gives 4
winrs -r:192.168.173.206 -u:lpu1 -p:$pwd 'powershell -command "2+2"'
# Gives Winrs error: Access is denied.
Configuration for my user is following:
(Get-Item WSMan:\localhost\Service\RootSDDL).value
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1141)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
(Get-PSSessionConfiguration -name Microsoft.Powershell).SecurityDescriptorSddl
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1149)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
(In each security descriptor my user is given general access to protected object).
So what security descriptor should I set to make my winrs query work for non-admin user?

Hi Bunyk,
I can not recreate the erroe you posted, and please also post the screenshoot in your convenience.
I tested with a non-domain user but has the local admin permission of the remote computer, and this worked, before running the remote cmdlet in powershell, I also configured the TrustedHosts.
In addition, the access denied could be also caused to the Protocol Filtering on the remote server, for more detailed information, please refer to this thread:
winrs error:access is denied
I hope this helps.

Password for user admin

Hello,
I have to change the PW for user admin and tried to do this in the ERP/SU01 on every client.
The connection to XI was lost. The error 'can not read exchange profile' occurred.
I reset the password of user admin in all clients to default and entered the user admin and password in the http://<xi-host>:<j2ee-port>/exchangeProfile.
This worked fine.
But now I get the periodic error that user admin on client 200 is locked due to wrong logon and XI does not work. Error as described above
Okay. I can unlock user admin, but the error occurs periodically.
Is there a description how to change the PW for user admin and get rid of this error. I found a SAP Note (936093), is this the way to do it?
I assume user admin is locked every time the portal fails to contact XI, but I am not sure.
Best Regards
Maximilian

Try reflashing the firmware and see if that alleviates the issue. If not call into 866-606-1866 for further troubleshooting.

GR and GR Non Val indicator in R/3 PO for multiple account assigned SC's

Hi,
We are on SRM 3.0(EBP 4.0) and R/3 4.7.
We have implemented the BBP_CREATE_PO_BACK badi for setting or clearing the GR and IR indicators under certian conditions.
But for Multiple account assigned SC's we get an error message "06181 With non-valuated GR, please also enter GR i ndicator ".
We have tried implementing note# 872000, but this has not solved the issue.
The PO's get created only if we force the GR indicator when transferring the data into R/3.
It seems clear that while creating the PO the system is encountering the GR Non Val indicator but not the GR indicator, so its throwing the error message (we get the same error message when we create the PO from R/3 with GRnon val indicator checked and GR ind unchecked).
The proposed solution is that in the same BADI, along with clearing the GR indicator, we will also clear the GR non val indicator.
This can solve the issue if the indicators are transferred as it is from EBP.
But can anyone tell me if these indicators are also checked/changed in any FM/program in R/3 before the PO is created?
Is there any customizing setting which is affecting this particular behaviour?
Regards,
Srivatsan

Hi Srivatsan ?
In ECC, you have a configuration point :
Materials Management->Account Assignment->Maintain Account Assignment Categories
Here you can untick the indicator you want by account assignment category;
Kind regards,
Yann

Task 0085 for parallel SID assignment terminated with errors

Hi,
While activating the ODS object we are getting the following error
Task 0085 for parallel SID assignment terminated with errors
Can anyone help me on this issue.
Thanks
Sheela Datla

Hi Sheela,
Does the problem happen with activating the ODS object (definition) itself or with activating the data in the
ODS? I think that there must be other errors apart from Task 0085. At the time of the error you should check in
sm21 and st22 for additional error messages and dumps. If the problem is with the activation of data in the ODS
you should also check sm37 for the job that is created for the ODS activation , you may find more detailed
information in the job log. You should also check the activation step in the 'Details' TAB in the monitor for
the load there may also be more detailed information here.
In transaction rscusta2 (ODS customizing) you should try the following setting for the activation:
No. of Par. Proc.    3
Min. No. Data Recs. 10000
Wait Time in Sec.      600
Before changing the values you have in RSCUSTA2 please take note of the values you have already in
case you want to change them back.
Best Regards,
Des.

Alerts in GRC 10 for FF Admin assignment

Similar Messages

Maybe you are looking for