Copying SAP_ALL profile

Hello,
Our client want to have a SAP_ALL profile without VA01, VA02, ME21N and ME23N.
I have copied sap_all profile and the single profile that has the stcode with the &SAP_ALL authorization: &_SAP_ALL_13. Then I have changed the stcode to limit the access to these transactions. All Ok till here. The point is that when I try to save the copy of the &_SAP_ALL_13 profile the message is:
Cannot activate.
The following authorizations are missing or have the status generated
And the profile isn't active and the authorizations are missing.
I have given a look at the objects definition of this profile, and they have the status active version - type generated. It looks like if they were have been created with PFCG, but this is not the case, isn't it? Do you know what can I do to solve it?
I know this is the usual way: I want all except X, Y ans Z, but after a few days they don't want some transactions more, and so on, the tale of never ending...
Thanks and best regards,
Ana.

> I know this is the usual way: I want all except X, Y ans Z, but after a few days they don't want some transactions more, and so on, the tale of never ending...
Nope, that is not the usual way. The usual way is to have people tell what they do need and build roles from that. The way you described is like building a house by excavating rooms from a big pile of building materials. It's bound to fail.
besides that, copying individual profiles is not the way to go.
If you insist on building a role based on SAP_ALL better go to PFCG, create a role and enter the profile. Here choose SAP_ALL as a template and work from there.
Disclaimer: This advice is not security related but only a way to get around the error messages.

Similar Messages

Copy sap_all profile to other role

hi
How i can copy sap_all profile to other role?

Hii sorry for the last post!
But don't just remove the transactions - make the objects display
only. There are many ways into the functionality, but it's controlled
ultimately by the objects
Rohit

How to copy and remove admin Role from SAP_ALL profile

Hi SDN Experts,
I need to copy SAP_ALL profile to another in CRM 5.0 system, thereafter i need to remove admin Role from SAP_ALL profile. Can any help regarding this point..
regds
gcp

Chandra,
I saw ur post in this forum regarding configuring sap intergration with genesys gplus adapter. We are in need of the same configuration. Can you please help me in configuring sap phone for gplus adapter. Reply me on [email protected]
Thanks in Advance

How to remove SPRO from SAP_ALL profile

Hi Friends,
Since my client needs access to SAP but we dont want to give them SPRO Tcode authorization.
So i would like to have your advice on that so as wht to be done and how can we create a profile without SPRO Tcode.
Regards
Ayush

Ayush Johri wrote:
> I think its not that difficult, although i dont know this. but i have heard people saying that they have made SAP_ALL profile without SPRO...
It is easy to copy SAP_ALL and create a role without SPRO
This will not stop people from accessing the functions behind SPRO for the reasons posted before.
Lots of people claim they create a SAP_ALL without SPRO, I will bet £1000 (I know it's worth many euro's at the moment) that 90%+ of those roles which people think have SPRO removed will not stop people accessing config.
Ask yourself this question....
If you build a house do you:
1. Buy a giant piece of rock and cut holes in it
2. Build it from components - bricks, windows, doors etc

Client Create and copying default profiles

Hi,
This is Sanjeev.. I have created a new client(678) in IDES ECC6 and now i went inside the new client(678) with sap* user and tried to copy default profile sap_all from 001 client using local client copy. It results in error saying rfc source destination for 001 is to be given.. ?? i also have the doubt whether the 000 client should be copied instead of 001.what is the proper procedure in creating and copying defaults...?? Kindly state it in steps...
Thanks a lot in advance....
Regards,
Sanjeev Kumar C

Hi,
You can find all the information you need at the below link,
http://help.sap.com/saphelp_erp2004/helpdata/fr/69/c24c0f4ba111d189750000e8322d00/frameset.htm
Regards,
Vishnu

I have an old user name tht is no longer accessible. I access fierfox through a new user name. I have copied the profile from the old user name. Can I have 2 profiles from which to choose when using firefox in the under the new username?

I have a user name on my computer that was tied in with the domain name of the server at my workplace. I would access Firefox under this user name. I have now changed jobs, and for good and obvious reasons can no longer utilize my previous company associated username.
I have set up a new username on the same computer. When I access Firefox, all of my old bookmarks are gone, because Firefox does not recognize me under the new username as the same person. In the meantime, I have established new bookmarks under the new username.
I have copied my profile from Firefox under my old username. Can I have two profiles under my new username and pick which one I want to use at that time when accessing Firefox?
I am running Windows 7 Professional, with 4 gig ram, Intel i3 CPU, 2.13 GHz, 64 bit operating system, Firefox 7.0.1
Thank you

You can not merge accounts.
Apps are tied to the Apple ID used to download them, you can not transfer them.

How to delete Client of SAP_ALL profile

I have make one client 800 in sap with SAP_ALL profile . now I want to delete this client because my harddisk space is going to Full. How I will delete Client 800 . So that my Harddisk should be free space.Please tell me step by step
Thanks & Regards
Jagdish Kumar

Proper way to delete a SAP client
Here goes:
1. log into the client to delete
2. go into SCC5 and delete client
3. log into another client and delete entry with SCC4
4. reorg database to recover database space.
Actually, if you check "on" the little "Delete Entry from T000" checkbox, you can skip step 3.
One other way of deleting a client which could give significant performance gain and save time is at OS level using - R3trans
To delete a client 200, you have to create a command file "del200" with following entries
Clientremove
Client = 200
Select *
Place the command file in /usr/sap/trans/bin
$ cd /usr/sap/trans/bin
$ R3trans w <log file name> -u 1 <command file name >
e.g $ R3trans -w del200.log -u 1 del200
To check the progress...
$ tail -f del200
Reorg the database post client delete

To find whether current user has SAP_ALL profile or not.

Hi all,
Can anyone tell me that whether is there any method by which I can pass the user id and can know whether that user has the SAP_ALL profile or not.
The above is done by using the transaction SU01,but I need the ABAP code that is being used in this transaction.
Regards,
Varun.
Message was edited by:
Varun Bhandari

Hi,
Check table USR02 for the same.
Regards,
Ram

How to Install (copy) ICC Profiles

I have two computers running fully updated versions of Mountain Lion. One has all the desired ICC profiles installed in Library>Printers>Epson>InkjetPrinter and in Photoshop the profiles show up just fine and I can make my selections.
On my other computer, the profiles had been there but disappeared in one upgrade or another. I tried having them installed automatically by deleting and reinstalling the printer drivers via the Print & Scan System Preferences. The driver gets re-installed but no profiles. I tried copying the profiles from the one computer to the exact location on the second computer and still no luck. Profiles of two of my other printers are all present, but not the one I'm trying to get added.
I have restarted many times along the way and even tried replacing the whole Epson folder with no change.
Does anyone have an idea of how I can copy those profiles to where they'll work?
FWIW, these profiles are for an older Epson 2200 which is still supported according to Apple's list. It works fine and does print perfect color through the computer that shows the profiles. Profiles for my Epson 7880 and Canon MX870 show on both computers.

Here is the location where the Epson v2.12 Printer Drivers for OS X (Oct. 4) will install the Stylus Pro 2200 .icc profiles. Everything from Printers inward is owned by root and group admin. The individual .icc files are read/write for root, and read only for everyone else.
I used CharlesSoft dot com Pacifist to discover this information. Downloaded the above Epson Driver dmg from Apple/support/downloads. Then opened it with Pacifist. Looked in Contents of EPSONPrinterDrivers.pkg. It is possible to drag the SP2200_A.profile and SP2200_W.profile bundles from Pacifist into the /Library directory hierarchy. You may have to create /InkjetPrinter2/ICCProfiles folders manually and permit them root:admin first.
Not for the faint of heart. If I was invested in Epson printers as you are, I would simply install the whole v2.12 installation package above. That should build the directory hierarchy for you. (fingers crossed).
/Library/Printers/Epson/InkjetPrinter2/ICCProfiles/SP2200_A.profiles
     Contents
          Resources
/Library/Printers/Epson/InkjetPrinter2/ICCProfiles/SP2200_W.profiles
     Contents
          Resources

Delete authority from SAP_ALL profile

Hi All,
In our application development we created a couple of authorization objects and profiles. Accidentally we add the authority to the SAP_ALL profile. How can we remove them?
Thanks, Jerome

Thanks a lot, Chris.
Jerome

Assigning SAP_ALL profile fail....

HI experts...
When i assign profile SAP_ALL to a new user it seems an error like "SAP_ALL profile does not exists or not active "
what i do?
thanks
sufiyan

Hi Sufiyan,
What is the component and release of your system? Can you also share screen shot? Where exactly are you trying to add sap_all?
Regards,
Shahid Ahmed

How to copy same profile options

Hi,
How to copy same profile option from one responsibility to another responsibility.
Can any one please suggest on this.
Regards,
Kishore.

I think what you mean is "how to copy profile option value from one responsibility to other".
You can use FNDLOAD to download the profile options values for the profile option.
The sample syntax for download is
FNDLOAD apps/apps O Y DOWNLOAD $FND_TOP/patch/115/import/afscprof.lct ORG_ID.ldt PROFILE PROFILE_NAME=”profile option” APPLICATION_SHORT_NAME=”FND”
It will create an .ldt file.
You can edit the ldt file and change the responsibility key to the new one. You may want to delete other entries and leave just one entry behind. An example is below
BEGIN FND_PROFILE_OPTION_VALUES "10003" "SC_US_OPI_DBI_INV_MGMT_M02" "OPI"
OWNER = "SYSADMIN"
LAST_UPDATE_DATE = "2012/04/03"
PROFILE_OPTION_VALUE = "95"
END FND_PROFILE_OPTION_VALUES
and then use FNDLOAD to upload the modified ldt file.
Sample syntax is
FNDLOAD apps/apps O Y UPLOAD $FND_TOP/patch/115/import/afscprof.lct ORG_ID.ldt
Sandeep Gandhi

Copying Roaming Profile - Errors

Hi,
I am following article
kb\314478 on making a roaming profile in XP, I created the roaming profile (user1) on \\laptop now when I try to copy it over to \\desktop I get 'Directory \\desktop\user1 could not be deleted please delete the directory and retry'.
So I go to \\desktop and delete it, try and copy it again from \\laptop\user1 to \\desktop\user1 and I get 'failed to set security on the destination profile - the network name could not be found'.
I don't know what to do, it's like an endless loop, I cant NOT have the folder but if I do it says it can't delete it.
Both computers have the everyone share permissions added, I've tried using administrator, user1, and administrators too, The NTFS permissions I've basically tried all users\groups that apply.
if you want the long names they are:
C:\Documents and Settings\User1 (for \\laptop\)
C:\Documents and Settings\User1 (for \\desktop\)
When copying the share I've tried setting the 'permitted to use' as everyone, administrator, administrators, and user1. Both computers are on the same network in a WORKGROUP and using XP pro.
The first time I tried it worked fine but I forgot to enter the username in 'authorized to use' something so I had to delete and copy it again and that's what the problems started.
Any ideas? as this is rattling my brains.
*EDIT I found a way to get roaming profiles working without having to copy the profile however I will leave this discussion open incase other people have this problem.

We experience the same message, reinstalled the ZfdAgent.msi install, and
now we never see the message. The problem is caused by the installation
of the Novell Client or the patches for the Client because they save over
top of some of the Zen files.
> We are using Windows XP SP2, ZFD 3.2 SP3 and Roaming profiles configured
> through user policy package (set to copy profile to user's netware home
> directory). When logoff/restart or shutdown the xp workstation, we get
>
> "Windows cannot update your roaming profile. Possible causes of this
error
> include network problems or insufficient rights. If this problem
persists,
> contact your network administrator"
> Detail: The system cannot find the path specified.
>
> There are two messages in Event Viewer:
> - Event ID 1504 - same error as above
> - Event ID 1509 - Windows cannot copy file C:\Documents and
> Settings\...\ntuser.ini to \\Zen1\profile\...
> Detail: The system cannot find the path specified.
>
> I looked at the userenv.log but it didn't mean much to me.
>
> Any ideas?
>

Restricting SCC4 Tcode, from the Role that was extracted from SAP_ALL profile

Hi,
Recently we have created a role extracting from SAP_ALL profile. We have deactivated many Basis, and other Critical Tcodes for our Dev & QTY systems by identifying the authorization objects.
But- for SCC4 we want to know if there is any other way to restrict the access.
Since we created the role by extracting the profiles from SAP_ALL. S_TCODE has * value, and S_TABU_CLI: has "X" value.
- problem is we cant deactivate or limit the usage of S_TABU_CLI:X as we have many ZTcodes for direct maintenance, which needs this AO.
- At the same time, we are trying hard to restrict SCC4.
So, please suggest if there is any other alternative way to restrict Tcode SCC4, by not being able to run using the New Role.
Regds,
Satish.

First of, let me say that I fully agree with Sunil Bujade. The building block approach is the way to go when designing roles.
But if we're being practical, you could use authorization groups for tables (T-code SE54) and assign a custom auth. group to table T000. Then use this group to authorize (or actually not authorize) with object S_TABU_DIS.
Again, this is just a practical tip. The whole "create a role from SAP_ALL" thing is a totally different subject altogether.
Good luck!
Dimitri.

BASIS: SAP_ALL profile locking

Hi guys, I have a a Novell driver that syncronizes the Active Directory with SAP, the problem is that F****'N driver gives the SAP_all profile to the new users.
I reported that no Novell
<b>but meanwhile, do you know if I could lock the SAP_all profile, the one and only user that I need to have it is SAP*
I need to lock it, do you know a way?</b>
many thanks

Hi,
I don't think that locking a profile is possible, even if its possible i don't think is a healthy thing to do... I will review that novell driver as there must be a setting specifying to use a particular profile when synchronizing users.
regards
Juan

Copying SAP_ALL profile

Similar Messages

Maybe you are looking for