Change Doc for Auth Changes to Profiles directly in Production
We use CUA and Profile Generator.
How can I prove that Roles and Authorizations in the profiles assigned to roles are not being edited directly in production (they are transported in).
When I use SUIM, for Roles, For Authorizations, or for any option under "For Roles"....I don't see any indication that the change came from the dev or assurance systems (nor any indication it was changed directly in production).
If I choose the "for authorization" view, it appears to find only a few temporary roles which could have been created and/or maintained directly in production. How can I be assured?
Our Transport logs from the dev system were a bit corrupted by a Client "refresh" copy action so I can't look at those to see if the date of change of the role coincides with a transport in E070 or E071 tables.
thank you for any thoughts!
PS Table CD1251 is not populated in our system.
>
David Berry wrote:
> Hi Bernhard
>
> Should this be allowed at all in prod? If an ungenerated role (or even one without a profile) makes it to production should security be generating? SUPC warns about generating in a productive client and there is the chance that a T-P* profile is created accidentally.
I would allow it, especially for emergency cases (maybe not for all admins). Nowadays with auth/new_buffering=4 it should not be so dangerous anymore to generate in production....
b.rgds, Bernhard
Edited by: Bernhard Hochreiter on Nov 17, 2010 3:47 PM
Similar Messages
-
Customize change docs for classification
Hi all,
I need to activate change documentation in order to be able to track changes for classification characteristics. In SPRO found that I can set it in Cross-Application Components >> Classification System >> Classes >> Maintain Object Types and Class Types
I'm interested in tracking changes of materials so chose table MARA and class type Material Class but to activate change docs there is need to set first "multiple objs allowed" and to do it I had to start RCCLUKA2 program. I did it for my class type, program has finished, it has created 2 files in DIR_HOME (DSKSSK,DSAUSP). Files are still on application server.
And here is my problem because checkbox "Multiple objs allowed" in SPRO still is not checked in spite of fact that program has finished without any errors. I tried to run report once again but got message: "Entries already exist in the INOB; check data"
I checked table TCLA field MULTOBJ and it's is empty for my Class Type. I have no idea what to do. Please help what to do in such situation and how to activate this change documentation for classification.
Thanks in advance for any help!
Best regards,
DarekThere are a couple of reason but part of it is following the whole "Don't change SAP standard, rather create a copy with a z naming convention for changes principle".
As a consulting company and given the fact that we are not the owners of the system, we sometimes don't have the opportunity to investigate if any objects are used elsewhere and in some cases, users themselves aren't aware that they are using the system in other areas (for example, some people don't realise that documents in the DMS are used in other areas like EH&S). By creating copies, we eliminate the possibility of making a change which may adversely affect another working area of the system that the project initiator is unaware of. It doesn't happen often that you make a change that impacts on others, but i'd rather take precautions than solve the issues afterwards.
We've also found that in some cases customers are incorrectly using something for the wrong purpose. For example, we found someone using the document structure type for reporting areas in another area of PM so we couldn't implement EasyDMS because they had changed one of the standard object types.
Edited by: Athol Hill on May 6, 2009 10:38 PM -
Need to trigger change pointers for a change in std text
I need to trigger an idoc via change pointers when any change in a std text occurs. I am doing this for changes in Customer Master. For example, if the std text obtained via tcode XD02 is changed, then I need to trigger an idoc. Is this possible? What is the object class used?
Thanks,
KeerthiHi,
All Standard text views are stored in V_E071.
Use the View for V_E071 for checking standard text transport
Give Object Filed Name = TEXT and check
And search the standard object
Go to se09 create workbench request and
Double Click the request and go to program give R3TR and Object: TEXT and object Name: TEXT, Nike_FT_AB_4700, ZEPC, D
Object: TEXT
Where Nike_FT_AB_4700 is Customized Name of Standard Text
Text Id: ZEPC (Default: ST)
Language: D (DE)
Go to SE03 double click the Search for Objects in Requests/Tasks in the
R3TR Object ; TEXT and do search.. with respective to that you will get change request.
Do rewards points. -
How to get to know change content for each change request
Hi, would I get to know the change content in each change request via SE09 or others before I release the change request?
For example, the following info was in SE09 tree view for a change via OB52. Would I get to
know what does "20000001 ZZZZZZZZZZ,20000002 ZZZZZZZZZZ" stand for?
EE6K900014 200 ADMIN tttts
EE6K900015 ADMIN Customizing Task
View Maintenance: Data
V_T001B
T001B
20000001 ZZZZZZZZZZ
20000002 ZZZZZZZZZZ
Thanks.
Edited by: yingying weng on May 27, 2009 5:10 AMyingying weng
To understand what is the transports, you need to understand the structures of the included tables, views, etc. Or at least be able to look the table information up in SAP.
For your example, table T001B (Permitted Posting Periods).
You can go to SE11 to see the fields in the table.
You can use SE16 to view the contents.
In this example you would be transporting the following:
T001B
20000001 ZZZZZZZZZZ
or
200 0 0001 ZZZZZZZZZZ
Client = 200
Record Type = 0
Posting Period Variant = 0001
To account = ZZZZZZZZZZ
Hope this helps.
PJ -
Creation of PD Profiles directly within Production environment.
The company I work for has recently upgraded all SAP environments, including where HR resides. Prior to the upgrade, we were able to create PD profiles directly within PRD, but now we are no longer since upgrading via OOSP which updates some of the T77* tables.
Does anyone know what type of config setting changes are required to allow us to return to being able to config PD profiles with PRD again?
Thanks in advance!
HIMASONI had the same problem and this is the solution I was given.
To make the OOSP table maintainable in production, in the production system go into the IMG path: Personnel Management> Personnel Development > Basic Settings > Authorization Management > Structural Authorizations the position cursor on the text Maintain Structural Authorization Profiles
Then go to Edit on the menu then Display IMG Activity.
Click on the tab Maint.Objects
Double click on the T77PQ
The Current Settings box needs to be ticked.
But first it looks like the system has to be set to modifiable (this is in table T000) OR do it in DEV and transport it through, - you need a developers key to do this. -
Business Object for Change doc object 'ADRESSE' Change or Create
Hi all,
I try to find the business object for ADRESSE when I change address of customer. I can trigger workflow when customer is created or change with change object DEBI and business object KNA1.
The problem is when user change street 2 or e-mail, DEBI won't be trigger. Only ADRESSE will be trigger. Any idea on how to link this or business object for ADRESSE? Is there any standard or I have to create customized one?
Point will be rewards for useful answer.
Thanks,
TonyHi Chai,
Can you help me on this?
Regards
Vinay -
Change docs for purchase order
Hi,
By which t.code we can see the chnage document for the purchase order. and which changes have been done?
Regards
Deepak SharmaHi,
You can check it in me22n or me23n itself.
Goto Environment -> Header Changes or Item Changes.
Rgds, -
Where can I see change documents for all changes to WBS elements
I have set up config via OPSA for both Basic Data and Status Management change documents to be allowed for nominated project profiles. I have then created a new project with the required project profile and whilst I can see the history for status management / user status. I am unable to see changes for other field information.
Is there a way to be able to see who changes the data like (wbs description, person responsible /applicant, profit centres etc)?
I have checked table JCDS and that only appears to give me status management.
Thanks
TrishTry transaction CJCD or CN60
Abraham -
Creating change pointers for inventory changes
Hello All,
We want to send the changed inventory information in MARD table for any article and site in field LABST. How do I create a change pointers so that any change to this field is logged in BDCPV table. How do I get that information and send it down to the website via XI. I would really appreciate any help. Please let me know what all config changes and/or IDOC I need to create etc.
Thanks
JohnGoto SAP easy access screen -MM-IM-Environment-inventory controlling-early warning system
<b>here you can create the exception using MC/1 for infostructure S039</b>
in this transaction u will select the char and then you can assing the mail whom u want to send or fax or ditri list
<b>then use MC/7 to create the system driven or event driven</b>
<b>then Using MC/B you can schedule this exceptions</b>
For More help
http://help.sap.com/saphelp_erp2005vp/helpdata/en/78/e1ec3410b5f563e10000009b38f83b/frameset.htm -
Change settings for apps, Change settings for apps
How do you change settings on apps
it depends what app, and it always appear in the menu of the game and depends too what type of setting are you talking about. greetings and hope this answer worke
-
Is there any change log for query change in BIW?
Hi Buddies,
Could you please tell me if there is a change log in BIW to record all changes made to query and workbook? Since yesterday, I found a very important query had been deleted from our BI system, but I did not who had done this.
Thanks in advanced.
best regards
PatrickUnfortunately there isn't. Check if you have the query in another system (test, development) and transport it again. You could also check if there is still an entry in RSRREPDIR but I don't think so.
Best regards
Dirk -
Change log for Distribution model and partner profile
Hello All,
Could any one please suggest how to get teh change log of the distribution model and partner profiles in SAP.
Thank you!
ArvindHello,
The documentation says what distribution model is used for. My question is can we have change log for any change in the distribution model like user, time and date.
In production system if distribution model and partner profiles are changed by someone to a destination which should not be used, then how can we trace who has changed it.
I hope I am able to explain.
Arvind -
Export and import change document for user master data
Dear Gurus,
I have two queries on change document for user master data:
1. Are there any approaches to export and import change document for user master data?
We often do system copy from PRD to QAS for UAT and troubleshooting. Before system copy we export the user master data from QAS and then import after the copy process. We would like to keep the change document for user master data on QAS from being refreshed from PRD for security reason.
2. Change document for Role change in QAS
When the role is created or modified in DEV and then transported to QAS, the role change document doen't include this change log. The role change document in QAS only records those role changes directly made in QAS.
Could you advise this is by SAP design or are there any approaches to record this transported role change in the role change document in QAS?
Thanks
YBY1. Perhaps you want to consider a system copy to a "virtual system" for UAT?
2. Changes in QAS (as with PROD as well) will give you the delta. They should ideally be clean... You need to check the source system.
Another option is to generate the profiles in the target system. But for that your config has to be sqeaky clean and in sync, including very well maintained and sync'ed Su24 data.
Cheers,
Julius -
Problem while generating Update progam for a Change Document Object
Hi,
I'm trying to deal with Change Document concept in a R/3 4.6C environment and to establish new Change Document object for my (Z)-table. I haven't using any namespace and created object with name ZTEST. Following the online documentation I came to the point, where I have to generate include program. I made all the nessesary inputs (using Z prefix) but faced
"Function module name is reserved for SAP"
Creating everything similarily using some of our registered namespaces (/somenamespace/) I succeed to generate the Update program and to integrate it in my Z-programs as well.
My question is: is it possible to use Change Document Object-names without predefined namespace - being a regular customer developer, but not an SAP developer - means, if I am allowed to manage programs in the customer namespace (Z,Y, X) only. If yes, how to do this?
Further (I decided not to open a new thread) - generated Update program uses
CALL FUNCTION 'xxxxx' IN UPDATE TASK
for creation of Change Numbers for generated Change Document Object. This CALL doesn't work when I implemented it in my Z-program, but when changed (IN UPDATE TASK was commented) - everything goes well and the system creates records in CDHDR/CDPOS tables for my object class and table.
Why is that? According to the documentation I shoud only fill appropriate variables for the Change Document Object (class, tr.code, etc.) and call generated FM, nothing is pointed out about any possible problems? Am I doing something wrong?
Well, to be precise, I think I have to give a sample:
1. I have a sample Z-table with few fields (their data elements are marked as Change-Document relevant).
2. Using own z-progam I created a new record for this z-table. Also fill all the nessesary variables included in the interface of generated FM for Change Document Object (for example - FM-mane CD_CALL_my_object).
3. I call the CDO FM.
4. Check what is happening (directly in both tables CDHDR/CDPOS or using FM CHANGEDOCUMENT_READ).
Further, I perfom the steps from 1 to 4 updating the created in previous loop record in my Z-table.
In both cases if the FM 'CD_CALL_my_object' is called IN UPDATE TASK nothing happens, but in case of direct call (without addition IN UPDATE TASK) the system behaves as expected. Well, obliously I can change the generated code for our production needs, but it doesn't seems to be the correct decision - in case of next possible modification of the Change Document Object definition, respectively in need of re-generation of the code.
Any hints are wellcome.
Thanks in advance.
Ivaylo Mutafchiev
Edited by: Ivaylo Mutafchiev on Jan 24, 2008 10:24 AM"IN UPDATE TASK" resolved by myself. The one should explicitly call 'COMMIT WORK' from Z-program after CALL FUNCTION '...' IN UPDATE TASK in order to get changes in the CDHDR/CDPOS commited. The key in this issue for me was to check the documentation of CALL FUNCTION :-).
Regards,
Ivo -
Dear Experts,
I need to create a customizing change event for LIKP,
but I couldn't find the change document for LIKP.
Did anyone has ever create change doc. for LIKP and
share experience ?
thanks in advance.
MinterDear Ramki,
Thanks for ur first reply.But after I create event
for the object LIEFERUNG, I could not see fields for table LIKP in SWEC.
Regards,
Minter
Maybe you are looking for
-
.gif files, in iPhoto?
Do .gif files work in iPhoto?
-
I would like to add a "i like" FB bouton in my e-mails. how can I do that?
I sent order confirmations to my clients and would like to add an "I like" bouton to my facebook site from my mac e-mail. How do I do that? Best regards Katrine
-
Error Message on Photoshop 8 Installation
I have just purchased Photoshop 12 and successfully (I think) installed the first file. When I try to install the .exe file, I receive an error message indicating that I am missing the Archive Part of Photoshop Elements 12. Where can I get this file?
-
Inline Posture between Cisco ISE and Wireless LAN Controller
Hi, I was looking into Cisco ISE solution for deploying NAC. I have a question about the network topology. In the user guide documents of cisco ISE, it is written that for Wireless LAN Controllers (WLC) and VPN devices, an additional server, Inline
-
Is it possible to have a splash page that you only see once?
Hello, I was hoping to find out if it's possible to have a splash page for a sign up form that you would see just once. If you skip the sign up form it takes you to the regular site and you never see the splash page again. Is something like that poss