Changing Login Parameters

Question

Hi All,
We are planning to implement the Password Policy for SAP users in our organization...
we want to change next parameters
Login/no_automatic_user_sapstar
Login/fails_to_session_end
Login/password_expiration_time
Login/min_password digit
Login/min_password_letters
Login/min_password_special
Login/min_password_diff
so I have some questions,
first of all this change will be applied in our productive system SAP CRM  ABAP 7.0 with MSSQL
what will be the impact when this change will be applied?, I mean the policies is inmediatly or for example it will be reflect until one user ask to be reset or until the expiration time defined will be get,
what will happen with comunication users?, I have seen some documentation when mentiion that just communication users of certain type will be affected,  I can't understand it,, someone has experience doing that?
so I'm worried about communication users because we have some importants users that communicate BPM(JAVA SAP) or ESB (JAVA IBM),
thank you..
Alfred

Answer 1

Alfredo,
To expand a bit on the answer to your first question, about when it will take effect, the answer is it depends.  It's true that the parameters don't take effect for the system until a restart, but as for when, after that, they impact the users depends on several factors.  Users will not be required to change their password until the expiration time has passed, but chances are that many of your users, if they've had accounts longer than the expiration time, will already be past that expiration time.  In that case, they will be asked to change their password with their next logons following the restart.  The exceptions will be people who have recently changed their password already or who have new user accounts.
As for the other parameters mandating password complexity, by default they will be applied the next time the user changes their password (which, for many, will be right away, as just described), but if the current password is not yet expired, it will be allowed to stand even if it doesn't meet the complexity rules until it does expire.  You can change this, however, with another parameter:  login/password_compliance_current_policy.  By default this parameter is inactive, but if you set it to 1, then users with passwords that don't meet the current complexity requirement will be forced to change right away, even if they are not expired.
With regard to your second question, about the impact of the new policy on your Communication users, here is the basic layout of impacts:
User Type
GUI Logon
Password Rules
Dialog
Yes
Yes
System
No
No
Communications
No
Yes*
Service
Yes
No
So yes, Communications users are subject to the password rules, but as Sunny was saying, generally the rules only impact interactive logons, and Communications users don't logon interactively (GUI Logon).  Still, if you want to be sure, you can change their type to System, and they still will not be able to logon interactively, and they will not be subject to password expiration.  Either way, they also will not be counted during license measurement.
Best regards,
Matt