RFC user get's locked

Hi experts,
We are using rfc_cua user for RFC communication between R/3 prd server and E-Rec prd server. Here issue is frequesntly rfc_cua user get's locked automatically. if we unlock the id it will work fine for one or two day and again it will get locked, There is no same amount of time gap between locking of this ID every time time. Kindly help me how to trace this issue.
Regards,
Sampath.

Are you using CUA or rfc user has been named just like that & what is E-Rec prd server .. is it SAP or something else ?
Dont u find something in change log of this user ??
thanks
ashish

Similar Messages

RFC User in CUA locked

Hello,
when i tried to unlock user both globally and locally (in cua) it failed..saying 'still the user is locked''..why ?
(refering rfc user here)
Thanks
Rajesh

Hi Rajesh,
Check this link:
When unlocking user ALEREMOTE, the user is still locked
Rajeev

Users get administrator locked when updating license tab in SU01

Hello All,
We are using a custom program which updates the license tab of the users in SU01 through BDC based on their classification.
But when we run the program some of the users are getting a status updated as "Locked by administrator''. We have checked the program but no code is written to lock the users. Is there any relationship between updating the license tab and the user getting locked by administrator status.
Your replies will be greatly appreciated.
Thankyou,
Ranjan

Hello,
License information determines how active users exists in the system and SAP can charge for each of those dialog users after doing system measurement in USMM ,SLAW transactions.
Check SUIM,whether your administrator has locked any users who have left the company etc. Lcoked means,inactive.
It is advisable to keep expiry dates to users rather than locking,once the suer leaves the company.
Regards,
chaitanya

SAP BW User getting locked by BO RFC calls

Hi,
we are encountering a problem with BO RFC calls locking SAP BW users that recently changed their password in BW.
Description of the problem in the ticket we raised at the SAP support:
SAP BO 4.1 SP2 Patch 4, linux installation
Backend: SAP BW 7.01 EHP8
BICS interface with SAP authentication
One of our users gets locked again and again in SAP BW (P19). The cause is a RFC connection that the BusinessObjects server (P59) tries to establish. The user used SAP BO last Friday for the last time and had to change his password in P19 this Tuesday. We think that there is some
process within SAP BO still trying to connect to SAP BW from time to time, using the old password. There is no open session visible for that user in the CMC. User is even getting locked when not in the office and during night time. RFC calls are established almost regualary every hour.
We already had this behaviour in our test-system. Restarting the BO-Server solved it. However, this is not the solution we want to use
in the productive environment. There has to be some way to kill the process that uses the old password on the BO server without restarting
the whole server. We do not understand why BO would still try to connect to BW with the old password - this has to be some kind of a bug.
Meanwhile the error disappeared for the first user (some days after it started, maybe the BO process ran into a timeout). However, other users started having the same behaviour after changing their password.
Our basis team tried to check the log files for advanced information on the conversations between BO and BW, but did not find any hints on which BO process might try to establish the connections.
The SAP support seems to be a little helpless at the moment...
Has anyone had similar problems?
Regards,
Robert

Hi again,
additional information: after approximately one week after the error appeared for the first time BO stops trying to establish the rfc connection for this specific user. Almost as if the "old-password-BO-process" ran into a 1 week timeout or something like that.
The problem is really strange. The SAP support is still not able to tell us how the gather the information they require.
Regards,
Robert

User gets locked by an external system but which one?

Hi,
In an abap system, we have changed the password of our administration user. Afterwards, this user gets locked every 5 minutes, obviously because the user and old password has been used to set up communication from another system to the abap system. An RFC connection for instance or whatever. Sure it is possible to check all the systems you can think of to see if the user has been used for such a purpose. But how can you see in the system itself where the call comes from that locks it? I have tried the gateway tracefile but without success. Any suggestions?
Regards,
GK

Hello,
I would try transaction STAD.
There you should find entries of type RFC with your user.
If you double-click on the line, you get the details. Click on the RFC button.
                              as Client             as Server
No. of targets                   0                     1
Click on the highlighted 1 under "as server".
You should get the needed info : the remote destination
Target         TEST_DEV
User ID        TESTOC
RFC Caller     OCHRETIE
Local destin. bt1suk17v1_DEV_02                IP address xx.xx.xx.xx
Remote destin. bt1suk16v1_DXI_68                IP address yy.yy.yy.yy
Hope this helps
Olivier

CUA SU10 issue with users getting locked

I did some role change using SU10 on CUA central system for 200 users. 45 of the users got locked with global admin lock in the child system for which I made the role changes. These user locks are shown in the child system change documents log as changes by the CUA RFC user. I have this problem everytime I use su10. Why does this happen? What can I do about it? Thanks, KT

Hi Todd,
propably you have some inconsistencies in your landscape....
the cause of such 'unwanted' effects is the fact that if you change a user in your CUA central system, the whole user information is picked, then edited with you changes and afterwards distributed to all child systems.
So what I could imagine in your example is as follows:
User has a global lock in central system already, the particular child system did not have that information (user is still unlocked there). Several causes are possible, for instance the lock idoc did not get processed, Child system was not available/connected to CUA when the lock had been set,......).
At the next update of that user (assign a role), the lock information from the central system is pushed to that child.
Why?
Because the design is to assure data consistency between central and child system. Therefore all the user information from central system is pushed to child at any user change. (that is also why you will see in SCUL 3 idocs for each user change (also user and profile idocs are pushed, even if you have changed the role assignement only).
So what you could check is, if that users got the lock flag (128) already in the past somewhen.
b.rgds, Bernhard

Impact of J2EE_ADMIN / Administrator user getting locked

Hi,
What is the impact of J2EE_ADMIN / Administrator user getting locked in abap / java engines? Will it effect startup of java server processes or java applications? What are the other implications?
Thanks,
Abdul

Hi Abdul,
if the J2EE_ADMIN or Administrator user is locked then
1. you cannot login to Visual Admin unless you define some other user with same authorization.
2. any Jco-RFC using this user won't work.
3. if you don't have any other user, you will have to activate SAP* user to unlock this user.
Thanks,
Sandeep

RFC user locked for guixt

Hi,
The communication user for guixt keeps getting locked. The RFC username & encrypted password are in the guixtrfc.ini which is distributed to each user PC. I'm thinking that somebody tried to edit the guixtrfc.ini & changed the encrypted password.
I need a method to either find out which front end PC has the bad guixt.ini or prevent the communication user from being locked (not all user accounts).
Thanks.
Stephen S.

Hi,
Thiugh am not exposed much to guixt the following document may help you to resolve your prob. Pl have a look.
http://www.synactive.com/download/sap%20gui%20scripting/sap%20gui%20scripting%20security%20settings.pdf
regards

PM Order is getting blocked by RFC user

Hi all, i'm facing the following problem. We've an FM that is invoked externally using an RFC user, that is used to change the status of an specific order. This FM first makes the ENQUEUE of the given object, with the following data:
    CALL FUNCTION 'ENQUEUE_ESORDER'
      EXPORTING
        mode_aufk            = 'S'
        aufnr                     = number
        _wait                     = 'X'
      EXCEPTIONS
        foreign_lock           = 1
        system_failure       = 2
        OTHERS               = 3 .
Then calls the standard FM STATUS_CHANGE_FOR_ACTIVITY and after that executes the
    CALL FUNCTION 'DEQUEUE_ESORDER'
         EXPORTING
              aufnr = number.
After that we have a COMMIT WORK.
Somehow and with no explicit reason, the given order remains locked by RFC user, sometimes for several hours.
This happen in Production System. We'd never get this kind of situation on pre-production.
Does anyone have any clue about this ???
Thanks for your kind attention.
Regards,

Hi Rahul,
Thanks for your answer. But it seems to me that the problem is not a question of authorization, because this same user is used in the same system for another processes.
For example, today we have an Order that is blocked in SM12 since 12:47:12 and the processes for closing it still remains active and waiting, but in another way for Orders of the same type during today, this situation doesn't occur and the respective processes were finished sucessfully.
Thanks anyway.
Regards,

User gets locked in lesser attempts than security policy setting

Hi
I have written my customized login code to login a user to the
portal and I user the following code:
IUser myUser = UMFactory.getUserFactory().getUserByLogonAlias(username, null);
IUserAccountFactory accountFactory = UMFactory.getUserAccountFactory();
IUserAccount account = accountFactory.getUserAccountByLogonId(myUser.getUniqueName());
ILogonAuthentication ILA = UMFactory.getLogonAuthenticator();
req.setAttribute(JUSER,myUser.getUniqueName());
req.setAttribute(JPASSWORD,password);
ILA.logon(req,res,AUTHSCHDEFAULT);
I notice that whenever I try to logon using my code with a
wrong password, the user gets locked in 3 attemps even though the security policy
(at ABAP and in Portal UME Configuration) setting for number of failed attempts is set to 5.
(Although, please note that my code works fine logging the
user into the portal when he enters the correct password)
I try to check if the same thing happens with the standard logon module - com.sap.portals.runtime.logon,
and notice that it locks correctly after 5 attempts.
Would I have to add anything else in my code to make it work
correctly?
Thanks
oj

Hi All
I tried to check in the CUA table the incorrect logon attempts value, and noticed that for every time I login (using my above code) with the wrong password, it increments the count by 2!! And that's the reason it gets locked out by the third time.
What am I doing wrong?
Thanks
OJ

Order not getting saved with RFC user

Hi CRM experts,
We have custom report to update payment card details in CRM order. For an error order when I try to update the card details in CRM it successfully deactivates the "Contains Error(I1030)" status and saves the order.
Whereas the same error order when I try to update the card details through external system, the user is RFC user, the program does not deactivates the status I1030 and the order gets saved with error.
Initially I thought it is an authorization issue with RFC user, so I tried applying SAP_ALL access to RFC user but it did not work.
Kindly suggest the possible solution.
Thanks in advance
Meenu.

Hi Meenu,
The standard one order framework works in such a way that when any changes to any object like PARTNER , HEADER , ITEMS , CARDS etc take place, then after changes done, the system checks for any inconsistency for that particular object and displays error messages accordingly.
At the next change, the check runs again and the messages are removed. The checks are run through the standard event framework of BEFORE and AFTER. So in case the error messages are not getting removed, it means that these events are not getting triggered properly. I think that you are using individual FM for changing the details which could be something like CRM*CARD*MAINTAIN*OW*, you can try using CRM_ORDER_MAINTAIN, as this FM triggers all events correctly.
/Hasan

RFC users locked after system copy in production system

Hi,
BW_User,MDBTC(RFC users) system users were locked in our BI Production system at the same time system copy activity was running in the Quality system(production to quality) so as per our colleagues concern after system copy they started Quality system with out changing background work-process 0 so some jobs were triggered which were copied from production system.
Is there any cause to lock RFC users in production system for system copy? If there is any other reason where we can check logs
Thanks
Jalandhar Reddy

Hi,
Well maybe i am wrong to analyze your problem .
Anyway I faced this issue to in our system before and we found that one background job was running in a system that has basically prompting an RFC connection to another system. In the t.code SM59 and there was wrong password was put in.We just reset the password and it was worked fine.
You can try for this..
Regards
Bhuban
RKFL

How to find if an user account is locked in weblogic server or not?

Hi,
I am using jdev 11.1.2.2.
SO i have set in web logic that if a user inputs login information wrongly his account will be locked.
How can i identify if the user account is locked.
Write now if the user account gets locked after say five invalid login attempts and user tries to enter correct login information its throwing exception . But i want to display to the user that his account is locked instead of the exception being thrown . How can i do it ? the following the login code i use
    public String doLogin() {
        LOGGER.log(ADFLogger.TRACE, "Clicked Login Button");
        LOGGER.log(ADFLogger.TRACE, "doLogin() Started.");
        String un = _username;
        byte[] pw = _password.getBytes();
        this.setPassword(null);
        FacesContext ctx = FacesContext.getCurrentInstance();
        HttpServletRequest request = (HttpServletRequest)ctx.getExternalContext().getRequest();
        try {
            Subject subject = Authentication.login(new URLCallbackHandler(un, pw));
            weblogic.servlet.security.ServletAuthentication.runAs(subject, request);
            String loginUrl;
            loginUrl = "/faces/home.jsf";
            HttpServletResponse response = (HttpServletResponse)ctx.getExternalContext().getResponse();
            sendForward(request, response, loginUrl);
        } catch (FailedLoginException fle) {
            FacesMessage msg =
                new FacesMessage(FacesMessage.SEVERITY_ERROR, "Incorrect Username or Password", "An incorrect Username or Password was specified");
            ctx.addMessage(null, msg);
        } catch (LoginException le) {
            reportUnexpectedLoginError("LoginException", le);
        return null;
    }Thanks & Regards,
Rakesh

chk this
http://vtkrishn.com/2011/09/27/implementing-userlockout-using-oam/

Audit Management- get the locking work at task level

Hi All,
I am working in Audit management and we have a requirement to get the locking for an audit work at low level i.e the task only will be locked if some person is working on that not the whole audit.
Ideally we would like the record locking to happen at the lowest level i.e. the action level.
At the moment it is happening higher up, which is causing us to lock each other out, and only one person seems to be able to work on it at a time. This is a major problem if we wanted to roll it out to a lot of other people to use.
Also, if it is possible it would be able to allow all users to upload documents and save them to a task, but not to be able to allow them to change the details within the task, e.g. description, dates etc.
Thanks in advance.
Tripti

Hi,
I dont fully understand your business requirement. However if you are trying control create, change of audit componentes, my inputs as below
You can define and assign a status profile with auth keys to control who can edit any audit component (AUO,AUP,QUN etc)and who cannot. I also suggest yout use Auth group to provide change access to fields in Audit components. These user group and auth key can be assigned to roles.
Some ABAP support is required to validate auth group and auth keys when the user logs in.
Please revert with your feedback.
Regards
Hemanth

How can SAP be configured to prevent users from consuming locks?

How can SAP be configured to prevent users from consuming locks?
The issue is that we want to prevent users to use upto maximum locks and so that we will not get lock table overflow issue. I know that we can assign parameter "enque/table_size" a good amount of value. But it is not for any specific user.
Also want to alert in CCMS if any user reaches to its maximum speficified limit of locks.
Thanks
Gopesh

You cannot set a limit of locks per user. There are two ways to reduce/control the number of locks:
- change fewer records within one transaction
- cover more records with one lock using wildcards
Basically it is an application / development issue.
Best regards, Michael

RFC user get's locked

Similar Messages

Maybe you are looking for