Change Doc for Auth Changes to Profiles directly in Production

We use CUA and Profile Generator. 
How can I prove that Roles and Authorizations in the profiles assigned to roles are not being edited directly in production (they are transported in). 
When I use SUIM, for Roles, For Authorizations, or for any option under "For Roles"....I don't see any indication that the change came from the dev or assurance systems (nor any indication it was changed directly in production). 
If I choose the "for authorization" view, it appears to find only a few temporary roles which could have been created and/or maintained directly in production.    How can I be assured?
Our Transport logs from the dev system were a bit corrupted by a Client "refresh" copy action so I can't look at those to see if the date of change of the role coincides with a transport in E070 or E071 tables.
thank you for any thoughts! 
PS Table CD1251 is not populated in our system.

>
David Berry wrote:
> Hi Bernhard
>
> Should this be allowed at all in prod? If an ungenerated role (or even one without a profile) makes it to production should security be generating? SUPC warns about generating in a productive client and there is the chance that a T-P* profile is created accidentally.
I would allow it, especially for emergency cases (maybe not for all admins). Nowadays with auth/new_buffering=4 it should not be so dangerous anymore to generate in production....
b.rgds, Bernhard
Edited by: Bernhard Hochreiter on Nov 17, 2010 3:47 PM

Similar Messages

  • Customize change docs for classification

    Hi all,
    I need to activate change documentation in order to be able to track changes for classification characteristics. In SPRO found that I can set it in Cross-Application Components >> Classification System >> Classes >> Maintain Object Types and Class Types
    I'm interested in tracking changes of materials so chose table MARA and class type Material Class but to activate change docs there is need to set first "multiple objs allowed" and to do it I had to start RCCLUKA2 program. I did it for my class type, program has finished, it has created 2 files in DIR_HOME (DSKSSK,DSAUSP). Files are still on application server.
    And here is my problem because checkbox "Multiple objs allowed" in SPRO still is not checked in spite of fact that program has finished without any errors. I tried to run report once again but got message: "Entries already exist in the INOB; check data"
    I checked table TCLA field MULTOBJ and it's is empty for my Class Type. I have no idea what to do. Please help what to do in such situation and how to activate this change documentation for classification.
    Thanks in advance for any help!
    Best regards,
    Darek

    There are a couple of reason but part of it is following the whole "Don't change SAP standard, rather create a copy with a z naming convention for changes principle".
    As a consulting company and given the fact that we are not the owners of the system, we sometimes don't have the opportunity to investigate if any objects are used elsewhere and in some cases, users themselves aren't aware that they are using the system in other areas (for example, some people don't realise that documents in the DMS are used in other areas like EH&S). By creating copies, we eliminate the possibility of making a change which may adversely affect another working area of the system that the project initiator is unaware of. It doesn't happen often that you make a change that impacts on others, but i'd rather take precautions than solve the issues afterwards.
    We've also found that in some cases customers are incorrectly using something for the wrong purpose. For example, we found someone using the document structure type for reporting areas in another area of PM so we couldn't implement EasyDMS because they had changed one of the standard object types.
    Edited by: Athol Hill on May 6, 2009 10:38 PM

  • Need to trigger change pointers for a change in std text

    I need to trigger an idoc via change pointers when any change in a std text occurs. I am doing this for changes in Customer Master. For example, if the std text obtained via tcode XD02 is changed, then I need to trigger an idoc. Is this possible? What is the object class used?
    Thanks,
    Keerthi

    Hi,
    All Standard text views are stored in V_E071.
    Use the View for V_E071 for checking standard text transport
    Give Object Filed Name = TEXT and check
    And search the standard object
    Go to se09 create workbench request and
    Double Click the request and go to program give R3TR and Object: TEXT and object Name: TEXT, Nike_FT_AB_4700, ZEPC, D
    Object: TEXT
    Where   Nike_FT_AB_4700 is Customized Name of Standard Text
    Text Id: ZEPC (Default: ST)
    Language: D (DE)
    Go to SE03  double click the Search for Objects in Requests/Tasks in the
    R3TR Object ; TEXT and do search.. with respective to that you will get change request.
    Do rewards points.

  • How to get to know change content for each change request

    Hi, would I get to know the change content in each change request via SE09 or others before I release the change request?
    For example, the following info was in SE09 tree view for a change via OB52. Would I get to
    know what does "20000001 ZZZZZZZZZZ,20000002 ZZZZZZZZZZ" stand for?
    EE6K900014 200   ADMIN        tttts
        EE6K900015   ADMIN        Customizing Task
            View Maintenance: Data
                V_T001B
                    T001B
                        20000001 ZZZZZZZZZZ
                        20000002 ZZZZZZZZZZ
    Thanks.
    Edited by: yingying weng on May 27, 2009 5:10 AM

    yingying weng 
    To understand what is the transports, you need to understand the structures of the included tables, views, etc.  Or at least be able to look the table information up in SAP.
    For your example, table T001B (Permitted Posting Periods).
    You can go to SE11 to see the fields in the table.
    You can use SE16 to view the contents.
    In this example you would be transporting the following:
    T001B
    20000001 ZZZZZZZZZZ
    or
    200 0 0001 ZZZZZZZZZZ
    Client                           = 200
    Record Type                 = 0
    Posting Period Variant = 0001
    To account                    = ZZZZZZZZZZ
    Hope this helps.
    PJ

  • Creation of PD Profiles directly within Production environment.

    The company I work for has recently upgraded all SAP environments, including where HR resides.  Prior to the upgrade, we were able to create PD profiles directly within PRD, but now we are no longer since upgrading via OOSP which updates some of the T77* tables.   
    Does anyone know what type of config setting changes are required to allow us to return to being able to config PD profiles with PRD again?   
    Thanks in advance!
    HIMASON

    I had the same problem and this is the solution I was given.
    To make the OOSP table maintainable in production, in the production system go into the IMG path: Personnel Management> Personnel Development > Basic Settings > Authorization Management > Structural Authorizations the position cursor on the text ‘Maintain Structural Authorization Profiles’
    Then go to ‘Edit’ on the menu then ‘Display IMG Activity’.
    Click on the tab ‘Maint.Objects’
    Double click on the T77PQ
    The Current Settings box needs to be ticked.
    But first it looks like the system has to be set to modifiable (this is in table T000) OR do it in DEV and transport it through, - you need a developers key to do this.

  • Business Object for Change doc object 'ADRESSE' Change or Create

    Hi all,
      I try to find the business object for ADRESSE when I change address of customer. I can trigger workflow when customer is created or change with change object DEBI and business object KNA1.
      The problem is when user change street 2 or e-mail, DEBI won't be trigger. Only ADRESSE will be trigger. Any idea on how to link this or business object for ADRESSE? Is there any standard or I have to create customized one?
      Point will be rewards for useful answer.
    Thanks,
    Tony

    Hi Chai,
    Can you help me on this?
    Regards
    Vinay

  • Change docs for purchase order

    Hi,
    By which t.code we can see the chnage document for the purchase order. and which changes have been done?
    Regards
    Deepak Sharma

    Hi,
    You can check it in me22n or me23n itself.
    Goto Environment -> Header Changes or Item Changes.
    Rgds,

  • Where can I see change documents for all changes to WBS elements

    I have set up config via OPSA for both Basic Data and Status Management change documents to be allowed for nominated project profiles.  I have then created a new project with the required project profile and whilst I can see the history for status  management / user status.  I am unable to see changes for other field information.
    Is there a way to be able to see who changes the data like (wbs description, person responsible /applicant, profit centres etc)?
    I have checked table JCDS and that only appears to give me status management.
    Thanks
    Trish

    Try transaction CJCD or CN60
    Abraham

  • Creating change pointers for inventory changes

    Hello All,
      We want to send the changed inventory information in MARD table for any article and site in field LABST. How do I create a change pointers so that any change to this field is logged in BDCPV table. How do I get that information and send it down to the website via XI. I would really appreciate any help. Please let me know what all config changes and/or IDOC I need to create etc.
    Thanks
    John

    Goto SAP easy access screen -MM-IM-Environment-inventory controlling-early warning system
    <b>here you can create the exception using MC/1 for infostructure S039</b>
    in this transaction u will select the char and then you can assing the mail whom u want to send or fax or ditri list
    <b>then use MC/7 to create the system driven or event driven</b>
    <b>then Using MC/B you can schedule this exceptions</b>
    For More help
    http://help.sap.com/saphelp_erp2005vp/helpdata/en/78/e1ec3410b5f563e10000009b38f83b/frameset.htm

  • Change settings for apps, Change settings for apps

    How do you change settings on apps

    it depends what app, and it always appear in the menu of the game and depends too what type of setting are you talking about. greetings and hope this answer worke

  • Is there any change log for query change in BIW?

    Hi Buddies,
    Could you please tell me if there is a change log in BIW to record all changes made to query and workbook? Since yesterday, I found a very important query had been deleted from our BI system, but I did not who had done this.
    Thanks in advanced.
    best regards
    Patrick

    Unfortunately there isn't. Check if you have the query in another system (test, development) and transport it again. You could also check if there is still an entry in RSRREPDIR but I don't think so.
    Best regards
    Dirk

  • Change log for Distribution model and partner profile

    Hello All,
    Could any one please suggest how to get teh change log of the distribution model and partner profiles in SAP.
    Thank you!
    Arvind

    Hello,
    The documentation says what distribution model is used for. My question is can we have change log for any change in the distribution model like user, time and date.
    In production system if distribution model and partner profiles are changed by someone to a destination which should not be used, then how can we trace who has changed it.
    I hope I am able to explain.
    Arvind

  • Export and import change document for user master data

    Dear Gurus,
    I have two queries on change document for user master data:
    1. Are there any approaches to export and import change document for user master data?
    We often do system copy from PRD to QAS for UAT and troubleshooting. Before system copy we export the user master data from QAS and then import after the copy process. We would like to keep the change document for user master data on QAS from being refreshed from PRD for security reason.
    2. Change document for Role change in QAS
    When the role is created or modified in DEV and then transported to QAS, the role change document doen't include this change log. The role change document in QAS only records those role changes directly made in QAS.
    Could you advise this is by SAP design or are there any approaches to record this transported role change  in the role change document in QAS?
    Thanks
    YBY

    1. Perhaps you want to consider a system copy to a "virtual system" for UAT?
    2. Changes in QAS (as with PROD as well) will give you the delta. They should ideally be clean... You need to check the source system.
    Another option is to generate the profiles in the target system. But for that your config has to be sqeaky clean and in sync, including very well maintained and sync'ed Su24 data.
    Cheers,
    Julius

  • Problem while generating Update progam for a Change Document Object

    Hi,
    I'm trying to deal with Change Document concept in a R/3 4.6C environment and to establish new Change Document object for my (Z)-table. I haven't using any namespace and created object with name ZTEST. Following the online documentation I came to the point, where I have to generate include program. I made all the nessesary inputs (using Z prefix) but faced
    "Function module name is reserved for SAP"
    Creating everything similarily using some of our registered namespaces (/somenamespace/) I succeed to generate the Update program and to integrate it in my Z-programs as well.
    My question is: is it possible to use Change Document Object-names without predefined namespace - being a regular customer developer, but not an SAP developer - means, if I am allowed to manage programs in the customer namespace (Z,Y, X) only. If yes, how to do this?
    Further (I decided not to open a new thread) - generated Update program uses
    CALL FUNCTION 'xxxxx' IN UPDATE TASK
    for creation of Change Numbers for generated Change Document Object. This CALL doesn't work when I implemented it in my Z-program, but when changed  (IN UPDATE TASK was commented) - everything goes well and the system creates records in CDHDR/CDPOS tables for my object class and table.
    Why is that? According to the documentation I shoud only fill appropriate variables for the Change Document Object (class, tr.code, etc.) and call generated FM, nothing is pointed out about any possible problems? Am I doing something wrong?
    Well, to be precise, I think I have to give a sample:
    1. I have a sample Z-table with few fields (their data elements are marked as Change-Document relevant).
    2. Using own z-progam I created a new record for this z-table. Also fill all the nessesary variables included in the interface of generated FM for Change Document Object (for example - FM-mane CD_CALL_my_object).
    3. I call the CDO FM.
    4. Check what is happening (directly in both tables CDHDR/CDPOS or using FM CHANGEDOCUMENT_READ).
    Further, I perfom the steps from 1 to 4 updating the created in previous loop record in my Z-table.
    In both cases if the FM 'CD_CALL_my_object' is called IN UPDATE TASK nothing happens, but in case of direct call (without addition IN UPDATE TASK) the system behaves as expected. Well, obliously I can change the generated code for our production needs, but it doesn't seems to be the correct decision - in case of next possible modification of the Change Document Object definition, respectively in need of re-generation of the code.
    Any hints are wellcome.
    Thanks in advance.
    Ivaylo Mutafchiev
    Edited by: Ivaylo Mutafchiev on Jan 24, 2008 10:24 AM

    "IN UPDATE TASK" resolved by myself. The one should explicitly call 'COMMIT WORK' from Z-program after CALL FUNCTION '...' IN UPDATE TASK in order to get changes in the CDHDR/CDPOS commited. The key in this issue for me was to check the documentation of CALL FUNCTION :-).
    Regards,
    Ivo

  • Change document for LIKP

    Dear Experts,
        I need to create a customizing change event for LIKP,
    but I couldn't find the change document for LIKP.
        Did anyone has ever create change doc. for LIKP and
    share experience ?
    thanks in advance.
    Minter

    Dear Ramki,
           Thanks for ur first reply.But after I create event
    for the object LIEFERUNG, I could not see fields for table LIKP in SWEC.
    Regards,
    Minter

Maybe you are looking for