Lock Inactive/Dormant users in SAP automatically

Hi Guys,
We have a requirement to find out a program/report which will lock the inactive dialog users if the user has not logged on for 90 days in the SAP system. This will be implemented in child system.
Please advise if there is any standard program/report available in SAP to achieve this task or we need to go for a customized program.
The restriction is only on the logon date/no. of days since last logon>=90, user lock currently=0 and user validity=Active user.
Thanks a lot and have a nice day!!
Ravi Pinjani.

Ravi,
Please look into the profile parameter -
login/password_max_idle_productive -
Specifies the maximum period for which a productive password (a password chosen by the user) remains valid if it is not used. After this period has expired, the password can no longer be used for authentication. The user administrator can reactivate password-based logon by assigning a new initial password. Permissible values: 0 – 24,000 (unit: days); Default value 0, that is, the check is deactivated Available after SAP NetWeaver 6.40
Your objective of preventing users from logging after 90days of inactivity can be handled easily by setting the value to 90 for this parameter. I don't think you need to reinvent the wheel for this by creating ABAP reports etc.
Regards,
Shivraj Singh

Similar Messages

Locking all the users

if we have locked all the users including sap* and accidently you have logged off.. ?? then how to come out of this situation.

You can modify the lock status of users directly in the database.
Go to table USR02 and set field UFLAG to 0 (locked it can be 128).
It should be sufficient for user SAP* to logon again an fix the rest.
Regards,
Daniela

[ConfigFwk:390105]Unable to create WLS change list due to a short term automatic lock obtained by user null

Hi,
I am getting this error while trying to activate a session in OSB (clustered env with 3 nodes). I have a OSB project which listens to a JMS queue. I was able to create the project fine and was able to activate the session, no issues. But when I tried to update the queue name or delete the project itself, this error gets thrown:
[ConfigFwk:390105]Unable to create WLS change list due to a short term automatic lock obtained by user null. The user has no pending changes and the lock will expire in 600 seconds. Please try again after the lock has expired.
Retrying after those seconds takes me back to the same error but the time get's reset to 600 sec.
I can change the code in that project and activate the session without any issues but if I change any configuration for proxy/business services or delete the project itself, i get this error. the only way to get around this issue is to clone the project and make changes to the cloned project. But, that is not the solution i am looking for as I don't want to keep a old version of the project and don't want to keep creating new queues everytime (since no two proxies can point to the same queue).
Oh, and this happens only with the projects which deal with JMS queues.
We are using OSB:
Oracle Service Bus Version: [Oracle Service Bus 11.1 Sun Dec 18 03:49:34 PST 2011 1447174]
Oracle Weblogic Server Version: [WebLogic Server 10.3.6.0.10 PSU Patch for BUG19637463 TUE NOV 04 15:54:42 IST 2014]
Please help.
Thanks,
Mukund.

Hi,
I am getting this error while trying to activate a session in OSB (clustered env with 3 nodes). I have a OSB project which listens to a JMS queue. I was able to create the project fine and was able to activate the session, no issues. But when I tried to update the queue name or delete the project itself, this error gets thrown:
[ConfigFwk:390105]Unable to create WLS change list due to a short term automatic lock obtained by user null. The user has no pending changes and the lock will expire in 600 seconds. Please try again after the lock has expired.
Retrying after those seconds takes me back to the same error but the time get's reset to 600 sec.
I can change the code in that project and activate the session without any issues but if I change any configuration for proxy/business services or delete the project itself, i get this error. the only way to get around this issue is to clone the project and make changes to the cloned project. But, that is not the solution i am looking for as I don't want to keep a old version of the project and don't want to keep creating new queues everytime (since no two proxies can point to the same queue).
Oh, and this happens only with the projects which deal with JMS queues.
We are using OSB:
Oracle Service Bus Version: [Oracle Service Bus 11.1 Sun Dec 18 03:49:34 PST 2011 1447174]
Oracle Weblogic Server Version: [WebLogic Server 10.3.6.0.10 PSU Patch for BUG19637463 TUE NOV 04 15:54:42 IST 2014]
Please help.
Thanks,
Mukund.

User Automatically Locked By Other User?

There was a UserID that was locked AUTOMATICALLY by the system but logged as locked by other user.
UserID B was locked by UserID A on 26th Oct. But UserID
A was on leave on 26th Oct. There is no way UserID
A could have logged in since UserID A 'Last Successful Login' was on 17th Oct.
Any explanation on this incident? Is there any way UserID B can lock UserID A without login into UME?

Hi John,
Look for batches / background jobs scheduled by User A and check if they can set a lock code for a user B (USR02-UFLAG <> 0)
Also I'd probably check if the user was still logged in the system on Oct 26 having entered the system on Oct 17th.
Just to give it a try.
Regards,
Mike

SAP Automatic Workstation Update user rights ?

Hi,
Does the workstation user need local admin rights to run SAP Automatic Workstation Update service ?
thanks
Vilius

Dear Villus
the "AWUS" user is the SYSTEM user.
The "AWUS" run as a service in the background.
Best regards, Sven

Create Substitute Users in SAP ECC 6.0

Dear Gurus,
Can someone guide on how to create a temporary user Substitute User) in SAP ECC 6.0. This is a user who will only use the SAP system for a short period while the substantive user is away on leave such that the system should lock the substitute user automatically when the leave preiod expires.
regards,
Chansa

> Very valid points on the PID's etc - hadn't thought of those!.
A lot of things are easily overlooked when designing substitution or emergency user procedures.
> Seems that, if the covering user doesn't have the authorisations in their UMR and has to fall back on the reference user's roles, it shows the reference user ID instead.
This would be very application specific and is not "mainstream". Where you can use it is with WAPIs (Workflow Application Program Interfaces) and BatchInput has been much the same for decades already.
> I'm not really sure if there''s a way around this as it may cause some questions internally but may benefit the business as the supplier/vendor etc think they are still dealing with their original contact.
On the backend you still have the created by and posted by fields for many application documents (all else being the same - which I would not rely on...).
> For small user groups, when one person is covering for another absent user in their user group then there shouldn't be any increased SoD figures (as long as reporting on org levels hasn't been activated in RAR) but we have found many instances where the covering user is either a team leader or similar which tends to increase SoD.
This is often because the user ID is changed (to a service user) when entering the "special mode". So access other user's (namely back to your own) spools, jobs, variants, layouts, work items, queries, office messages, etc etc is needed, and these are generally protected by strong administrator authority-checks. These will in combination provide many SoD conflicts or usually over-riding system admin access which makes the application restriction pretty weak in comparison.
> Pity it (SM20N) doesn't seem to work by user group but not bad at all...
It does via naming conventions, but is backward compatible for those already logging SAP* user and expecting no entries, which would then become all users starting with the name SAP... See Rz11 param rsau/user_selection (default is "off").
> Can't make the Berlin conference unfortunately but thank you for the welcome to SDN.
You can keep an eye out for "SDN Hacker Lunch" in the news streams. After the event, I normally put the infos and discussions together into a blog on SDN.
Cheers,
Julius

How to use CMS Users with SAP BOPC NW 7.5

Hello,
I have problems importing and using CMS Users with BO PC 7.5 NW.
I am trying two types of CMS-users
1. CMS Enterprise Users created in CMS and using "Enterprise" authentication
2. SAP BW Users imported into CMS using their SAP authentication "secSAPR3")
but both don't work:
In the BOPC Admin Client, I can succesfully select Security->Users->"Add new Users". Both CMS "Enterprise Users" and CMS Users that use SAP authentication are displayed in the "Everyone" Group.
The CMS Enterprise Users are displayed as <username>, e.g. "Miller".
The CMS users with sap authentication are displayed as <SAPSystem><Client>/<SAPusername>, e.g. "KBE100/Smith".
Now If I try to import a user...
1. CMS Enterprise Users
If can successfully import CMS Enterprise Users and add them to the ADMIN Team, e.g. "Miller".
The problem is they can't be used to log in to the Admin Client and Excel Client:
E.g. I enterUser-ID "Miller" and his CMS-Enterprise-password under password after starting Excel Client, an error message shows up: "The UserID, Password or Domain cannot be authenticated. Go back and make sure you entered valid credentials" ... (same error message as if the user wouldn't exist/wrong pw.).
Seems the user wasn't added as BO PC user. Or do I need to use any prefix before the "user ID" for CMS Enterprise users in the User_ID field instead of just "Miller"?!
2. CMS Users which use SAP-authentication (users imported into CMS from BW and use SAP-authentication)
In the BO PC Admin Client, I can't import them: I go through "1. User Setup" select "KBE~100/Smith", "2. User Detail", "3. Assignments", but if I am in "4. Finish" and click on "Apply", the following error shows up:
"Failed to create directory \root\Webfolders\<AppSetName>\<Appname>" for "KBE~100/Smith".
My guess is that the operating system doesn't like the "/" in the Username - but I guess this can't be changed bc. these Users from CMS and are already displayed with the "/" between SAPSystemID~ClientNummer and username in the User-list in BOPC Admin Client!
side remark: if I create a SAP CMS Enterprise user which contains a "/" in the username (on pupose ), I am getting the same error message.
Any help, explanations and workarounds are greatly appreciated - Any solution will be awarded with maximum points!
Best Regards and thanks a lot for your help!

Hi Florian,
The problem seems indeed the file system on the bw not being able to handle "/". The automatic user import from the bw role into the CMC does not give you an option to replace the "/" character with anything else.
This should solve it:
- Go to the CMC double click the user. Delete the server part "KBE100/" and click save. Make sure the default system is set to "KBE100". The user should now be able to login from BPC with the user Smith.
Good luck,
Martin

Issues while creating new user in SAP HANA

Hello Team
When i am trying to create a new user in SAP HANA studio i can see that there has been a new field added of DATA validity where there are two options a) Valid From and b)Valid Unitl . No matter whatever dates i give in this i got this error which creating the user . Status :- inactive
Reason :- outside validity period . PFA screen shot attached below . Please suggest what dates should be given in this field with some sample example .
Regards

Prag,
Try this. Execute the following in a SQL window started by a userid that has been granted the USER ADMIN system privilege:
ALTER USER BODS1 VALID FROM NOW UNTIL FOREVER;
You can use a date instead of FOREVER --- '2016-12-31 23:59'.
Good luck,
Robert

Error while query execution - Query getting locked by another user execute

Hi All,
I am facing an issue ..
When I execute a query I am getting an error message ie popping as blocked by some other user. And I able to see the lock when I go to SM12. If the other user logged off or if we unlock his entry, then both the workbook and query is getting executed as expected. What can be the reason for this phenomena?
In my understanding, in the same time multiple users can execute the query /workbook. But in our case its not allowing.
Can someone suggest a resolution at the earliest, as it is affecting the reports in live environment
Regards
Mathew

The Bex Analyser (Front end) Patch is 501 and the SAP BI is 15.
The error message that I am getting while executing the query is "The object requested is currently locked by user --".
When I go to SM12, I can see a lock in the user's name.

How to make the workflow users as active users in SAP R/3

Hi All,
We have got an issue in R/3 system where a certain number of users who are created only to approve work flows via Outlook emails.
They are not required to log in to the system at all. Due to this,the users are getting locked by a Security background job which locks all the inactive users.
Now My question is how to make these work flow users as active users in R/3 system so that we can avoid locking of these users.
Awaiting your response.
Thanks in advance
Ramkumar C

Hi All,
We have got an issue in R/3 system where a certain number of users who are created only to approve work flows via Outlook emails.
They are not required to log in to the system at all. Due to this,the users are getting locked by a Security background job which locks all the inactive users.
Now My question is how to make these work flow users as active users in R/3 system so that we can avoid locking of these users.
Awaiting your response.
Thanks in advance
Ramkumar C

Cisco ISE: How to identify/inactive old users?

Hello,
I want to get all users / mac-adresses which haven't connected to out network since 180 days.
How can I query that?
The report "Dormant Users" dont seems to be the right way: it displays current associated users which are inactive...
How can I purge Cisco ISE : cleaning it from useless, old, inactive mac-addresses?
Thank you very much for any answer

The only thing I could find was purging data in the MNT node. The default is 90 days. This doesnt apply because the profiles are store on the policy node. I dont think you can in an automated form.
You could change the MNT to purge after 210 days and then run a report to see which macs have not authc in the passed 180 days. That will require excel and some scripting.

Locking R/3 User

Hi,
We are developing a Webdynpro application.
We have multiple screens or views to create or update a record related to any particular r/3 user.
Since we have multiple screens and we are updating data for each screen. How can we lock R/3 user till the time we click on 'Save' button of last screen?
Thanks & regards,
Nilesh.

Hi,
for more information on locks, see http://help.sap.com/saphelp_nw2004s/helpdata/en/c2/2d7037ecc92a7ee10000009b38f8cf/frameset.htm
Regards, Heidi

Do we have any API to Lock-Unlock the User

Hi all,
i want to check the status of the user(Unlock or locked) through my webdynpro application and depending on the condition,i want to change the status.
please guide me in doing so.
Thanks and Regards,
Mithileshwar Dayal Sahu.

Hi,
You can use interface IUserAccount.
There are methods :
isLocked()
isPasswordLocked()
isUserAccountLocked()()
lockDate()
setLocked(boolean lock, int reason)
http://help.sap.com/javadocs/NW04S/current/se/com/sap/security/api/IUserAccount.html
Regards
Abdul.

Getting error "Document is locked by other user, please try again later"

Hi Sap gurus,
We have one invoice which is in approver's list. The approver is not able to neither approve this nor reject this invoice, the error message he gets is "Document is locked by other user, please try again lateru201D. We have checked SM12 and we could not find ant lock on this object for the user.
We have tried few function modules indicated below to unlock the work item, to change the status, to complete the work item, to forwarding this work item by another user and finally even to delete the work item.
SAP_WAPI_SET_WORKITEM_STATUS
SAP_WAPI_WORKITEM_DELETE
SAP_WAPI_UNLOCK_WORKITEM
SAP_WAPI_WORKITEM_COMPLETE
SAP_WAPI_FORWARD_WORKITEM
We have also tried deleting this invoice from the system, but still we get the same error. Can any body please help us providing the any other function modules by which we can unlock an invoice or to delete the invoice from the SRM system.

Hi,
Please review note 1277002 Wrong error message "Document is locked..." for Invoice. And also note 1178295 BBPAPPROVAL: Document gets locked by the User.
These notes should resolve this issue.
Kind Regards,
Lisa

How to avoid: Material data locked by another user

Hi,
'Material data locked by another user'
We want to avoid this kind of situation so that two different users can do the transactions on same material at same time.
Regards,

hi,
As per SAP std. configuration its not possible...And if we the reason...then it good for a user...
so, that once the user 1's work is not done fully user 2 can't work untill then and by this we avoid making of extra GR/IR or any of the duplicate documents...
Regards
Priyanka.P

Lock Inactive/Dormant users in SAP automatically

Similar Messages

Maybe you are looking for