CUA SU10 issue with users getting locked

I did some role change using SU10 on CUA central system for 200 users. 45 of the users got locked with global admin lock in the child system for which I made the role changes.  These user locks are shown in the child system change documents log as changes by the CUA RFC user. I have this problem everytime I use su10. Why does this happen?  What can I do about it? Thanks, KT

Hi Todd,
propably you have some inconsistencies in your landscape....
the cause of such 'unwanted' effects is the fact that if you change a user in your CUA central system, the whole user information is picked, then edited with you changes and afterwards distributed to all child systems.
So what I could imagine in your example is as follows:
User has a global lock in central system already, the particular child system did not have that information (user is still unlocked there). Several causes are possible, for instance the lock idoc did not get processed, Child system was not available/connected to CUA when the lock had been set,......).
At the next update of that user (assign a role), the lock information from the central system is pushed to that child.
Why?
Because the design is to assure data consistency between central and child system. Therefore all the user information from central system is pushed to child at any user change. (that is also why you will see in SCUL 3 idocs for each user change (also user and profile idocs are pushed, even if you have changed the role assignement only).
So what you could check is, if that users got the lock flag (128) already in the past somewhen.
b.rgds, Bernhard

Similar Messages

  • CUA SRM issue with user/business partner creation

    Hi Board,
    I've already replied to an existing thread in the SRM board, but also quite hopefully to find somebody here who may be able to help. Please find the thread here
    error during creation of EBP suers
    Any help would be highly appreciated as we can go on with this "work around" for the moment but not willing to change our current architecture.
    Many regards,
    Richard

    Hi Suchandra,
    Are you trying to default Business Roles & Authorizations at the time of SAVE of a new CP?
    If yes, then everytime you click on SAVE button on CP Create Screen the Save BADi will be triggered.
    Cases when its not getting triggered please debug into the event handler method of view-BP_CONT/BPCONTOverview->EH_ONSAVE method.
    In this method at line (below) the save badi is triggered:-
    IF cl_crm_uiu_bp_tools=>save( ir_message_service = lr_msg_service ) = abap_true.
    In the above method - CL_CRM_UIU_BP_TOOLS=>SAVE( ) the save event handler is triggered :-
    * trigger ON_SAVE for registered handlers
      raise_save_event( ).
    If you want the default to happen when you navigate to CP Screen , you'll have to put the defaulting code in an implementation of a different badi - BADI_CRM_BP_UIU_DEFAULTS.
    - Dedeepya
    Edited by: dedeepya reddy on Nov 15, 2011 2:07 PM

  • User gets locked in lesser attempts than security policy setting

    Hi
    I have written my customized login code to login a user to the
    portal and I user the following code:
    IUser myUser = UMFactory.getUserFactory().getUserByLogonAlias(username, null);
    IUserAccountFactory accountFactory = UMFactory.getUserAccountFactory();
    IUserAccount account = accountFactory.getUserAccountByLogonId(myUser.getUniqueName());
    ILogonAuthentication ILA = UMFactory.getLogonAuthenticator();
    req.setAttribute(JUSER,myUser.getUniqueName());
    req.setAttribute(JPASSWORD,password);
    ILA.logon(req,res,AUTHSCHDEFAULT);     
    I notice that whenever I try to logon using my code with a
    wrong password, the user gets locked in 3 attemps even though the security policy
    (at ABAP and in Portal UME Configuration) setting for number of failed attempts is set to 5.
    (Although, please note that my code works fine logging the
    user into the portal when he enters the correct password)
    I try to check if the same thing happens with the standard logon module - com.sap.portals.runtime.logon,
    and notice that it locks correctly after 5 attempts.
    Would I have to add anything else in my code to make it work
    correctly?
    Thanks
    oj

    Hi All
    I tried to check in the CUA table the incorrect logon attempts value, and noticed that for every time I login (using my above code) with the wrong password, it increments the count by 2!! And that's the reason it gets locked out by the third time.
    What am I doing wrong?
    Thanks
    OJ

  • Issue with User decision handler in UWL

    Hi Friends,
      I am facing an issue with user decision hander in UWL. We have modified the XML file to show up the comments box to enter the rejection reason, this is working fine with two approval tasks already but the same thing is not working now with a new task id. In the back end(R/3) everything is the same for both the tasks, in the Portal side my portal consultant says the same. But we were not able to figure out the issue. I even created a new task and tried to use implement the handler changes, but still it is not working. Please advice what could be the issue

    Hi,
    can you elaborate what the issue, what do you mean by not working. you are not getting the reason box, or it's giving error,something like that.
    Hope we'll be more clear then about your requirement.
    venu

  • User gets locked by an external system but which one?

    Hi,
    In an abap system, we have changed the password of our administration user. Afterwards, this user gets locked every 5 minutes, obviously because the user and old password has been used to set up communication from another system to the abap system. An RFC connection for instance or whatever. Sure it is possible to check all the systems you can think of to see if the user has been used for such a purpose. But how can you see in the system itself where the call comes from that locks it? I have tried the gateway tracefile but without success. Any suggestions?
    Regards,
    GK

    Hello,
    I would try transaction STAD.
    There you should find entries of type RFC with your user.
    If you double-click on the line, you get the details. Click on the RFC button.
                                  as Client             as Server
    No. of targets                   0                     1
    Click on the highlighted 1 under "as server".
    You should get the needed info : the remote destination
    Target         TEST_DEV
    User ID        TESTOC
    RFC Caller     OCHRETIE
    Local  destin. bt1suk17v1_DEV_02                IP address xx.xx.xx.xx
    Remote destin. bt1suk16v1_DXI_68                IP address yy.yy.yy.yy
    Hope this helps
    Olivier

  • Impact of J2EE_ADMIN / Administrator user getting locked

    Hi,
    What is the impact of J2EE_ADMIN / Administrator user getting locked in abap / java engines?  Will it effect startup of java server processes or java applications?  What are the other implications?
    Thanks,
    Abdul

    Hi Abdul,
    if the J2EE_ADMIN or Administrator user is locked then
    1. you cannot login to Visual Admin unless you define some other user with same authorization.
    2. any Jco-RFC using this user won't work.
    3. if you don't have any other user, you will have to activate SAP* user to unlock this user.
    Thanks,
    Sandeep

  • SAP BW User getting locked by BO RFC calls

    Hi,
    we are encountering a problem with BO RFC calls locking SAP BW users that recently changed their password in BW.
    Description of the problem in the ticket we raised at the SAP support:
    SAP BO 4.1 SP2 Patch 4, linux installation
    Backend: SAP BW 7.01 EHP8
    BICS interface with SAP authentication
    One of our users gets locked again and again in SAP BW (P19). The cause is a RFC connection that the BusinessObjects server (P59) tries to establish. The user used SAP BO last Friday for the last time and had to change his password in P19 this Tuesday. We think that there is some
    process within SAP BO still trying to connect to SAP BW from time to time, using the old password. There is no open session visible for that user in the CMC. User is even getting locked when not in the office and during night time. RFC calls are established almost regualary every hour.
    We already had this behaviour in our test-system. Restarting the BO-Server solved it. However, this is not the solution we want to use
    in the productive environment. There has to be some way to kill the process that uses the old password on the BO server without restarting
    the whole server. We do not understand why BO would still try to connect to BW with the old password - this has to be some kind of a bug.
    Meanwhile the error disappeared for the first user (some days after it started, maybe the BO process ran into a timeout). However, other users started having the same behaviour after changing their password.
    Our basis team tried to check the log files for advanced information on the conversations between BO and BW, but did not find any hints on which BO process might try to establish the connections.
    The SAP support seems to be a little helpless at the moment...
    Has anyone had similar problems?
    Regards,
    Robert

    Hi again,
    additional information: after approximately one week after the error appeared for the first time BO stops trying to establish the rfc connection for this specific user. Almost as if the "old-password-BO-process" ran into a 1 week timeout or something like that.
    The problem is really strange. The SAP support is still not able to tell us how the gather the information they require.
    Regards,
    Robert

  • Issue with users trying to save reports to thier Documents on one drive.

    I am working
    on a 2013 SharePoint environment and users who use Power View reports.  I
    have a user who can create reports on a site I have set up (no problems
    there).  They can also save reports to PowerPivot Gallery they have added
    in their Newsfeed for their personal site (no problems here).  The problem
    is when they try to save the report and go to Documents on one Drive it fails
    with below error message.  I am an admin but can save just fine to my
    documents.  I know the error shows an access issue but not sure where or
    how to resolve this issue for users.  <o:p></o:p>
    P.S. the
    issue happens before they even save button it happens when they see the My
    Documents and try to open it.  Again it is there personal SharePoint site
    so not sure why they would not have access.<o:p></o:p>
    SoapAction: ListChildren
    HttpStatus: 500
    ServerErrorCode: rsAccessDenied
    ServerError: <detail><ErrorCode xmlns="http://www.microsoft.com/sql/reportingservices">rsAccessDenied</ErrorCode><HttpStatus xmlns="http://www.microsoft.com/sql/reportingservices">400</HttpStatus><Message
    xmlns="http://www.microsoft.com/sql/reportingservices">The permissions granted to user 'HQEAGLEVIEW\levi.bond' are insufficient for performing this operation. ---&gt; Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException:
    The permissions granted to user 'HQEAGLEVIEW\levi.bond' are insufficient for performing this operation.</Message><HelpLink xmlns="http://www.microsoft.com/sql/reportingservices">http://go.microsoft.com/fwlink/?LinkId=20476&amp;EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&amp;EvtID=rsAccessDenied&amp;ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&amp;ProdVer=11.0.3412.0</HelpLink><ProductName
    xmlns="http://www.microsoft.com/sql/reportingservices">Microsoft SQL Server Reporting Services</ProductName><ProductVersion xmlns="http://www.microsoft.com/sql/reportingservices">11.0.3412.0</ProductVersion><ProductLocaleId
    xmlns="http://www.microsoft.com/sql/reportingservices">127</ProductLocaleId><OperatingSystem xmlns="http://www.microsoft.com/sql/reportingservices">OsIndependent</OperatingSystem><CountryLocaleId
    xmlns="http://www.microsoft.com/sql/reportingservices">1033</CountryLocaleId><MoreInformation xmlns="http://www.microsoft.com/sql/reportingservices"><Source>ReportingServicesLibrary</Source><Message
    msrs:ErrorCode="rsAccessDenied" msrs:HelpLink="http://go.microsoft.com/fwlink/?LinkId=20476&amp;EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&amp;EvtID=rsAccessDenied&amp;ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&amp;ProdVer=11.0.3412.0"
    xmlns:msrs="http://www.microsoft.com/sql/reportingservices">The permissions granted to user 'HQEAGLEVIEW\levi.bond' are insufficient for performing this operation.</Message></MoreInformation><Warnings
    xmlns="http://www.microsoft.com/sql/reportingservices" /></detail>
    here is actual screen shot
    <v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f">
     <v:stroke joinstyle="miter">
    <v:formulas>  <v:f eqn="if lineDrawn pixelLineWidth 0">
      <v:f eqn="sum @0 1 0">
      <v:f eqn="sum 0 0 @1">
      <v:f eqn="prod @2 1 2">
      <v:f eqn="prod @3 21600 pixelWidth">
      <v:f eqn="prod @3 21600 pixelHeight">
      <v:f eqn="sum @0 0 1">
      <v:f eqn="prod @6 1 2">
      <v:f eqn="prod @7 21600 pixelWidth">
      <v:f eqn="sum @8 21600 0">
      <v:f eqn="prod @7 21600 pixelHeight">
      <v:f eqn="sum @10 21600 0">
     </v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:formulas>
     <v:path gradientshapeok="t" o:connecttype="rect" o:extrusionok="f">
     <o:lock aspectratio="t" v:ext="edit">
    </o:lock></v:path></v:stroke></v:shapetype><v:shape alt="" id="Picture_x0020_1" o:spid="_x0000_i1025" style="width:7in;height:426.75pt;" type="#_x0000_t75">
    <v:imagedata o:href="cid:[email protected]" src="file:///C:\Users\KEN~1.CRA\AppData\Local\Temp\msohtmlclip1\01\clip_image001.png">
    </v:imagedata></v:shape>
    Ken Craig

    Hi Ken,
    It's strange that the User Profile Service Application is not available there. Please use PowerShell to check it, and you can run the command below:
    Get-SPServiceApplication | where-object{$_.DisplayName -like 'User Profile*'}
    Please ensure you are connecting to the correct farm, and open PowerShell with administrator permission. Meanwhile, add a test user in your Active Directory, and test to see whether the user's My Site can be created.
    If the User Profile Service Application can be listed by PowerShell, and the new user's My Site can be created, there might be an UI issue in your Central Administration. Otherwise, you may consider to recreate or restore your User Profile Service Application.
    Here are references:
    https://technet.microsoft.com/en-us/library/gg985419.aspx
    http://sharepoint.stackexchange.com/questions/55087/user-profile-service-application-unable-to-create-a-new-user-profile-service-ap
    https://joanneklein.wordpress.com/2011/11/08/recreated-user-profile-service-application-deletes-user-profiles/
    Thanks,
    Reken Liu

  • J2EE_ADMIN user getting locked frequently

    Hi SAP Guru's,
    The user J2EE_ADMIN in our nw2004s system is getting locked frequently. We have changed the password of this user in ABAP via SU01 & in JAVA in the secure store via configtool. The server was re-booted after doing these changes. Still the user J2EE_ADMIN is getting locked frequently. Also in SM21, we have a log <b>"J2EE_ADMIN locked due to incorrect logon"</b> for this locking which mentions the user as SAPJSF (Communication user between ABAP & JAVA).
    Is there a possibility that SAPJSF is locking the user J2EE_ADMIN ?? how & why ??
    Any help on this will be highly appreciated.
    Thanks,
    Sanjeev.

    have you solve this issue? we have the same!
    every half hour (xx:51:00 and xx:29:00), the J2EE_ADMIN user is locked by user SAPJSF transaction KRNL from the local host (terminal).
    We have changed the pass in secure store in configtool to the pass we used in abap.
    In "Visual Administrator" "Cluster>Server>Services-->Security Provider" the user have a checked box at "No password change required"
    We searched for other places with a wrong pass (Jco Connections = no J2EE_ADMIN used, SLD = no J2EE_ADMIN used), but found nothing.
    need help pls.
    regards
    chris

  • User getting Locked after 1 day

    Hi All,
    I am facing an issue...a particular user in our SAP ECC 5.0 system is getting locked after every one day, I checked the configuration in SU01 but everything seems to be fine there.
    Please help regarding this issue.
    Thanks in Advance
    Regards,
    Prashant.

    Dear Prashant,
    Have you activated user trace.If yes then monitor that user ID.It wont be possible that only 1 particular user is getting locked (correct me if I am wrong).There can be a possibility that somebody is deliberately entering wrong password for his ID any other terminal.
    If you have activated user trace then you can easily monitor that user ID and even the terminals from where his ID has been accessed.
    PS: I might be wrong,so please update me with the latest.
    Regards,
    Ashutosh

  • User getting locked while sending message sync via BPM. Please help

    Hi Experts,
       I have a sync - sync scenario where I am sending data synchronously from webservice to a sync RFC FM. I am using BPM and in BPM I have three steps
    1. Receive step - Opens Sync-Async Bridge
    2. Sync Send step
    3. Send step - Closes SYnc-Async bridge.
    This BPM solution is same as that give in the blog https://www.sdn.sap.com/irj/sdn/weblogs?blog=/pub/wlg/1403 [original link is broken] [original link is broken] [original link is broken]
    When I test this scenario I am getting
    <SAP:Error xmlns:SAP="http://sap.com/xi/XI/Message/30" xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/" SOAP:mustUnderstand="1">
    <SAP:Category>XIServer</SAP:Category>
    <SAP:Code area="INTERNAL">PL_TIMEOUT</SAP:Code>
    <SAP:P1 />
    <SAP:P2 />
    <SAP:P3 />
    <SAP:P4 />
    <SAP:AdditionalText />
    <SAP:ApplicationFaultMessage namespace="" />
    <SAP:Stack>Timeout condition of pipeline reached</SAP:Stack>
    <SAP:Retry>N</SAP:Retry>
    </SAP:Error>
    When I check the "Status monitor for Sync/Async communication" via SXMB_MONI, I found that my message is listed there with BPE status = "Wait".
    On double clicking my message I found that there is an error " User is locked. Please notify the person responsible".
    Why is my BPE struck in "Wait" stage and user is locked?
    What am I doing wrong? Am I missing any settings in SOAP sender communication channel?
    Please help me in resolving this problem.
    Regards
    Gopal

    Hi,
    Few months ago we had also problems with "locked user" in XI, in our case XIAPPLUSER was sometimes (b)locked.
    Perhaps note:
    721548 Changing the passwords of the XI 3.0 service users
    will help you.
    We removed and entered the service users again, with the password in CAPITALS and language blank.
    After that our problem was solved, I hope yours too.
    Regards
    Jack

  • Issue with request.get parameter

    Hi all,
    I am working on a developing a for  the users to request access to portal. on submit of the form a mail is sent to user and a page for the successful submission is displayed.
    When transported to Q system we started to get a null pointer exception on submitting the initial form. On investigating further I saw that the request.get parameter is not getting the values in the second page.Please let me know if there is any thing to be done at the portal level to solve this issue. As it is the same code and iview on both the systems.

    Hi,
    It might be issue with Permissions, And also Everyone role with end user permission is assigned or not in QA.
    Compare the permissions in dev and qa to resolve the issue.
    http://<hostname>:<port no>/irj/servlet/prt/portal/prtroot/com.sap.portal.admin.acleditor.listPermissions
    Hope this helps.
    Cheers-
    Pramod

  • ACS SE 4.1.1.23 patch 5 issue with users

    HI There, I am facing very weired issue with ACS SE 4.1.1.23 patch 5. I am trying to add users in ACS it is added successfully but I can not see these users when I click list all users.
    But I can see users are increasing in groups when I add users..but when I do list all users it say there are no users defined. and I tried to login with newly created users from devices  ....I am able to login with those new users.....
    also when I go to that particular group in which I added new users....and say list users in group...I get message from ACS saying that "can not read users from group" ....
    what could be issue any one has any idea....customer complained that he was unable to login to devices...with the users created on ACS...when I saw there was no users in database....then I added 2-3 users by looking at old passed and failed authentication... but I dont know how users got deleted automatically...even I tried to see appliance audit logs...could not see any thing which indicates someone deleted users...
    please help me to solve this issue..
    Thanks

    Issue resolved. The CRL that was being parsed from the cert was one level higher than the CRL that needed to be checked. The User CRL was ppointing to the Intermediate CA's CRL. I had to manually change the URL from this:
    http://DOMAINvmsp.DOMAIN.xxxx-xx.edu/pkipub/DOMAIN%20Intermediate%20CA%201.crl
    to this:
    http://DOMAINvmsp.DOMAIN.xxxx-xx.edu/pkipub/DOMAIN%20User%20CA%201.crl
    Mark

  • Variations issues with User & Group Site Column value

    Hi all,
    I have created variation sites. e.g. http://mydomain/en-us for english & http://mydomain/de-de for german language. I have created custom page layouts. This page layouts are based on custom content types. I have created a column called "User"
    which is type of "User/Groups". I am registering this column to my page layout.  http://mydomain/de-de is my default site.
    Now I am editing column called "User" on page & save it. It saves data properly. But when I am propagating these changes to another site that is http://mydomain/en-us. It shows me all controls with values filled. but with "User"
    column, its showing me blank value.
    Any suggestion. ?
    Thanks in advance.

    http://webcache.googleusercontent.com/search?q=cache:kNlxGIj5f1kJ:sjoere.blogspot.com/2007/11/5-reasons-why-you-should-not-use.html+&cd=2&hl=en&ct=clnk&gl=in
    Content types not propagated
    Risk
    When you add a content type to a page library in the variation source, this type is not automatically propagated to the other labels (see
    my previous post). If you then create a page with that content type in the variation source, it does get published to the other labels but loses its content type field values.
    Proposed solutions
    Set up your site via a site definition that already contains the proper content type bindings to the page libraries. All labels will use the same content types
    Put a good governance plan in place to make sure manual changes are done in every label
    If this helped you resolve your issue, please mark it Answered

  • SLD User gets locked; four unsuccessful logons every 15 minutes

    I have a landscape with a PI with the SLD on it. I defined a user with the name SLDUSER and the appropriate authorizations. The PI is a Unicode system, like all systems in the landscape.
    There were already some application servers (CRM, Banking Services, Composition Environment) connecting to this SLD and everything went fine.
    Now I added another application server, an ERP, for FI-CAx (NW 7.02). As the business partners are distributed via XI through the PI system, the ERP needs to connect to the SLD, too.
    I set it up as usual:
    - sldapicust: host, port, SLDUSER, password. (What is weird is that there is no test button as in all the other systems ... maybe that depends on the installed EhPs.)
    - This generated the destinations (type T = TCP/IP) SLD_UC and SLD_NUC automatically.
    - I created destinations SAPSLDAPI and LCRSAPRFC manually in sm59, type T = TCP/IP, set them to Unicode, entered the same (two different) Registered Server Programs that are used in these destinations on all the other servers (CRM, PI, BaS).
    - I ran rz70, entered the host and gateway, activated, executed the data collection.
    SLDCHECK runs successfully on the ERP system!
    The technical system for the BS1 showed up in the SLD as expected.
    - I configured the clients / business systems on the SLD.
    Now begins the problem. The SLDUSER is now getting locked all the time! It's definitely the ERP system causing it - when I prevent it from accessing the PI (by changing the hosts file on the operating system), the problem stops.
    I activated everything critical related to logons and RFCs in sm19 and looked at the logs in sm20. This is what it looks like:
    17.08.2011     19:40:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Password check failed for user SLDUSER in client 001
    17.08.2011     19:40:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Logon Failed (Reason = 1, Type = U)
    17.08.2011     19:40:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Password check failed for user SLDUSER in client 001
    17.08.2011     19:40:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Logon Failed (Reason = 1, Type = U)
    17.08.2011     19:40:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Password check failed for user SLDUSER in client 001
    17.08.2011     19:40:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Logon Failed (Reason = 1, Type = U)
    17.08.2011     19:40:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Password check failed for user SLDUSER in client 001
    17.08.2011     19:40:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Logon Failed (Reason = 1, Type = U)
    17.08.2011     19:55:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Password check failed for user SLDUSER in client 001
    17.08.2011     19:55:04     BNK_RFC     ilbnkpi1          SAPMSSY1     User SLDUSER Locked in Client 001 After Erroneous Password Checks
    17.08.2011     19:55:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Logon Failed (Reason = 1, Type = U)
    17.08.2011     19:55:04     BNK_RFC     ilbnkpi1          SAPMSSY1     Logon Failed (Reason = 53, Type = U)
    17.08.2011     19:55:05     BNK_RFC     ilbnkpi1          SAPMSSY1     Logon Failed (Reason = 53, Type = U)
    17.08.2011     19:55:05     BNK_RFC     ilbnkpi1          SAPMSSY1     Logon Failed (Reason = 53, Type = U)
    And it goes on like this. So what happens is this: Every 15 minutes, at :10, :25, :40, :55, there are four unsuccessful logons with SLDUSER. With the fifth logon it gets locked.
    Again:
    - This stops when I make the PI inaccessible to the ERP.
    - SLDCHECK still works completely fine in ERP - until the SLDUSER is locked, of course; then it stops working in all connected systems. It does not result in unsuccessful logons on the PI.
    - When I run rz70 on the ERP and run the data collection this also reports success and does not create unsuccessful logons on the PI.
    - I have not used the SLDUSER in any other locations besides sldapicust.
    So what the hell is wrong with this system?!

    I have created a separate user SLDUSER_ER1 just for use in the sldapicust in the new ERP system that causes the problem. Still SLDUSER is getting locked (not SLDUSER_ER1)!
    I powered down this ERP system ER1, just to make absolutely sure it is causing the problem - indeed the unsuccessful logon attempts every 15 minutes stopped right away.
    As a workaround and for narrowing down the problem I have created separate users SLDUSER_CR1 etc. for each of the other systems in the landscape (CRM and so on) - indeed those do not get any unsuccessful logon attempts.
    I have deleted all four SLD-related destinations in ER1 and recreated them from scratch (SLD_NUC and SLD_UC being generated when running rz70). I also used the "delete all batch jobs" button in rz70.
    Still, SLDUSER is getting locked.
    I checked on the PI system in C:\usr\sap\PI1\DVEBMGS00\j2ee\cluster\server0\log\system\httpaccess\responses_00.0.trc and see it is indeed the IP of the ERP system that gets the error 401 exactly at the times when the unsuccessful logon attempts occur:
    [Oct 2, 2011 2:46:06 PM   ] - 10.26.83.234 : POST /sld/cimom HTTP/1.1 401 1499 [140]
    [Oct 2, 2011 2:46:06 PM   ] - 10.26.83.234 : POST /sld/cimom HTTP/1.1 401 1499 [79]
    [Oct 2, 2011 2:46:06 PM   ] - 10.26.83.234 : POST /sld/cimom HTTP/1.1 401 1499 [62]
    [Oct 2, 2011 2:46:06 PM   ] - 10.26.83.234 : POST /sld/cimom HTTP/1.1 401 1499 [47]
    As the ERP has no Java instance and the sldapicust does not contain the SLDUSER (but the new SLDUSER_ER1) it is a mystery to me what it is that is still running every 15 minutes in the ERP and tries to use SLDUSER.
    I went through the entries in SECSTORE and could not find any use of SLDUSER (only of SLDUSER_ER1, as it should be).
    Edited by: Monika Eggers on Oct 2, 2011 3:08 PM

Maybe you are looking for