Role removal workflow

Hi experts,
I'm trying to understand what's needed to remove user roles using workflow.  My understanding was that I needed to use the same workflow for user provisioning and just treat the removal as a user change (SAP_GRAC_ACCESS_REQUEST) but when executing the workflow I get the word "ERROR" under "Stage Status" (even thought nothing is showing up on SLG1 or ST22).  Is there something that needs to be added to the workflow to allow the removal of roles?  We are on GRC 10.1

This is what I see on GRFNMW_DBGMONITOR_WD.  The detour condition is coming with an Error but when I simulate the conditions for that request I get expected results.  After the error message the request staus goes to "Decision Pending" but it doesnt show any approver.

Similar Messages

  • Roles vs Workflow for manual update record issue

    I am sorry for taking your time but I need some HELP as we go life with MDM and there is still one open topic that is connected to workflow implementation. 
    Do you have maybe someone who can advice me a solution or workaround to solve this issue. See description below.
    We are using role based workflow (few of workflows triggered one by one depends on the task that needs to be performed)
    As agreed with our client the several users are not allowed to:
    Modify (add/remove) original records
    Start workflows
    Check out / roll back records 
    Our solution provides them with option to do any kind off modification on Check Out records, and that action is triggered as automatic result of import records.
    NOW a small issue appeared since the import from MDP is made based on a new rapport that does not have several fields that we where using to determinate what items from materials will change. 
    So the next idea was to do that manually since it happens only few times a year for more or less 10 items. And that is where the problems started.
    I want to have a small workflow that will do as follows:
    Check Out Record -> Allowed to make changes -> Send to the next step (Approval process will be started)
    but we do not want to allow them do Checkout record or add to job
    (It can be only acceptable if we can allow them to add to ONE of the workflows but not all of them)
    I tried also to use the trigger actions Record Update2 but Workflow checkout occurs after record update (update applied to original record) so that is not applicable to, as since we want to keep original data in case someone rejects the new changes (that way we can always go back to original records). I would rather need something like Record Import only without the import part (it checks out the record and only then it allows to do any changes). ;P
    If the description is not clear let me know I will try to “translate it to easier English”
    Hope to hear from someone soon 
    Aleksandra

    From reading your question, I gather the following:
    You would like for users to be able to edit a record, which will automatically trigger a workflow, and if it's rejected then it should roll back the changes.  However, the user should not be able to manually start the workflow, it must be started and launched automatically on record edit.  Does that sound correct?
    If so, then you may have an issue.  While an edit can be used to launch a workflow, the workflow is not geared towards approving that edit.  It's assumed that other changes will be made, and those changes are the ones that will be approved or rejected.  This seems a bit strange I know, and hopefully this issue will be addressed in future versions.  However, I think you're only alternative is to have the users be able to start their own workflows.  You can probably use a security role such that a user can't modify normal records, but can only modify records that are checked out to them.  Then you would have to modify your workflow such that it only contains one record at a time, this way the user would not be able to add multiple records to the workflow.
    Does that make sense?  I hope this helps.

  • Remove Workflow Instance From Queue

    Hi Experts,
    We encounter a problem in UCM workflow. Somehow the content of some workflow instances is no longer exists in the system (Don't know why), but the workflow instances are still active. This cause the cps portlet fails to render the approval portlet.
    We have tried login as the workflow instance owner in UCM Admin page (http://host:16200/cs), and go to My Content Server > My Workflow Assignments, remove the offending workflow instance manually.
    However we don't know how much workflow instances are affected, we would like to remove all offending workflow instances by a single administrative account i.e. "weblogic", but we found that we are not able to do this as the Content Items In Workflow "workflow_name" does not include the offending workflow.
    Is there any SQL update to the data in the OCS schema to batch remove the workflow instances?
    Ziho

    Hi Jiri,
    Thanks for the suggestions, below are some more information on the issue.
    if you can afford that, the easiest way how to get rid of running workflow instances is to disable an re-enable the criteria workflow(s) that contain it. Be aware that you will lose all workflow statuses of the disabled workflows.We can't afford that as it is a production system
    Workflows, however, store workflow statuses on filesystem, so I'm not sure if database operations will be enough.I think so, we tried login as workflow owner, there is a function to "Remove workflow from queue" for specified workflow instance under All Active Workflows --> My Workflow Assignments. However after the removal of the workflow instances, we can't find any data modification in the OCS schema, related tables include WORKFLOWDOCUMENTS, WORKFLOWDOCATTRIBUTES, DOCUMENTS, DOCMETA, REVISIONS and REVCLASSES
    by doing so, the admin should see the items - not in My Workflow Assignment, though. You will need to click the name of the wokflow and then, you should see all the items in the particular workflowYes, the admin i.e. "weblogic" can view all active workflow instances WITH content associated with it, but offending workflow instances (i.e. the one WITHOUT content somehow) do not show up.
    We believe, if no things go wrong, that all active workflow instances can be found by running the following sql statement "select * from WORKFLOWDOCUMENTS;". However, in our case, workflow instances without content can be found using the same sql, but do not show up in UCM web UI login as "weblogic".
    Last, but not least, you should analyse how come an item in a workflow could be deleted.We encountered this during high load (Generated by Stress Test Tool), without login UCM web UI as admin role to delete content.
    the admin deleted the item in Repository Manager whilst it routed in a workflow.We tried using admin role to delete content in Repository Manager, it popup error when we tried to delete content which are in active workflow. We had to either Approve or Reject it before we can delete it (which I think the workflow maybe not in active state anymore, i don't know..)
    See if any other suggestion I can get. Thanks for the input.
    Thanks,
    Ziho

  • GRC 10.0 Mass Role removal

    Hello all,
    we are using GRC AC 10.0 (SP14). Today I found out that the access removal for multiple user is not working. The role removal for one User is working fine. But for multiple user who all have the same role it is not possible to select this existing role. Is it a standard in GRC AC or did I miss some config parameters?
    The  button "ADD" (yellow) is not working, and there is no button "Existing assignements". Please let me know, whether this settings are standard or not.
    Many thanks,
    regards
    Sabrina

    Sabrina,
    Multi user requests have been quite problematic. I encourage you to search for corrections; we had to implement numerous corrections for multi-user requests. Right now, though, multi user requests for role removal using the "Existing Assignment" function are working for us (SP12 with a lot of corrections from  SP13 and SP14).
    I should mention that our Provisioning Log in the closure notification only lists the first user, but all three accounts in my test request just now had the role removed as requested. We have treated that as a training issue with our request submitters for the time being. We implemented Note 1727135 to correct that issue and it made matters worse, so we had to revert.
    Good luck!
    Gretchen

  • How to use rules and roles in workflow?

    Hi experts,
    I am a beginner in  workflow. Could  any one tell me how to use rules and roles in workflow ?
    Can u pls tell me the steps to follow?
    and more over what are all the <b>important things</b> we have to learn in workflow module ??
    I shall be thankful to u.
    Thanks
    uma

    Hi
    Workflow automates the steps and activities in a business process according to predefined procedures and rules.
    Workflow presents information and documents to the appropriate knowledge worker or agent (another entity such as a program) to make a decision or perform an activity.
    Workflow tracks each and every step in the process flow and maintains an ongoing status.
    Workflow also collects and reports all of the metrics associated with the execution and completion of the process.
    Check the below links u will get lot of info..
    http://www.sap-press.com/product.cfm?account=&product=H950
    Workflow
    http://www.sap-img.com/workflow/sap-workflow.htm
    http://help.sap.com/saphelp_47x200/helpdata/en/a5/172437130e0d09e10000009b38f839/frameset.htm
    For examples on WorkFlow...check the below link..
    http://help.sap.com/saphelp_47x200/helpdata/en/3d/6a9b3c874da309e10000000a114027/frameset.htm
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    http://help.sap.com/saphelp_47x200/helpdata/en/4a/dac507002f11d295340000e82dec10/frameset.htm
    http://www.workflowing.com/id18.htm
    http://www.e-workflow.org/
    http://web.mit.edu/sapr3/dev/newdevstand.html
    Go through the following links on FORK :
    http://help.sap.com/saphelp_nw04/helpdata/en/24/e2283f2bbad036e10000000a114084/frameset.htm
    http://help.sap.com/saphelp_nw04/helpdata/en/8d/25f1e7454311d189430000e829fbbd/frameset.htm
    http://help.sap.com/saphelp_46c/helpdata/en/c5/e4a930453d11d189430000e829fbbd/content.htm
    http://www.insightcp.com/res_23.htm
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMSTART/BCBMTWFMSTART.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMDEMO/BCBMTWFMDEMO.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMPM/BCBMTWFMPM.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    For more reference on workflow: http://****************/Tutorials/Workflow/Workflow.htm
    http://help.sap.com/saphelp_erp2005vp/helpdata/en/04/9277a346f311d189470000e829fbbd/frameset.htm
    Check these links.
    http://www.sapgenie.com/workflow/index.htm
    /people/ginger.gatling/blog/2005/12/01/link-workflow-business-objects-to-your-collaboration-tasks
    http://help.sap.com/saphelp_nw04/helpdata/en/92/bc26a6ec2b11d2b4b5006094b9ea0d/content.htm
    http://help.sap.com/saphelp_bw33/helpdata/en/92/bc26a6ec2b11d2b4b5006094b9ea0d/content.htm
    http://help.sap.com/saphelp_bw31/helpdata/en/8d/25f94b454311d189430000e829fbbd/content.htm
    http://www.sap-press.com/product.cfm?account=&product=H950
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    http://www.workflowing.com/id18.htm
    http://www.e-workflow.org/
    Workflow
    http://www.sap-img.com/workflow/sap-workflow.htm
    http://help.sap.com/saphelp_47x200/helpdata/en/a5/172437130e0d09e10000009b38f839/frameset.htm
    For examples on WorkFlow...check the below link..
    http://help.sap.com/saphelp_47x200/helpdata/en/3d/6a9b3c874da309e10000000a114027/frameset.htm
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    http://help.sap.com/saphelp_47x200/helpdata/en/4a/dac507002f11d295340000e82dec10/frameset.htm
    http://www.workflowing.com/id18.htm
    http://www.e-workflow.org/
    http://web.mit.edu/sapr3/dev/newdevstand.html
    http://www.sap-img.com/workflow/sap-workflow.htm
    http://help.sap.com/saphelp_47x200/helpdata/en/a5/172437130e0d09e10000009b38f839/frameset.htm
    For examples on WorkFlow...check the below link..
    http://help.sap.com/saphelp_47x200/helpdata/en/3d/6a9b3c874da309e10000000a114027/frameset.htm
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    http://help.sap.com/saphelp_47x200/helpdata/en/4a/dac507002f11d295340000e82dec10/frameset.htm
    http://www.workflowing.com/id18.htm
    http://www.e-workflow.org/
    http://web.mit.edu/sapr3/dev/newdevstand.html
    Workflow tutorials with step-by-step and with screenshots are available at http://www.****************/Tutorials/Workflow/Workflow.htm
    http://help.sap.com/saphelp_erp2005vp/helpdata/en/42/c14a9b55103116e10000000a1553f7/frameset.htm
    http://help.sap.com/saphelp_erp2005vp/helpdata/en/c5/e4a930453d11d189430000e829fbbd/frameset.htm
    http://www.sapgenie.com/workflow/
    http://www.sap-img.com/workflow/sap-workflow.htm
    http://help.sap.com/saphelp_47x200/helpdata/en/3d/6a9b3c874da309e10000000a114027/frameset.htm
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    http://help.sap.com/saphelp_47x200/helpdata/en/4a/dac507002f11d295340000e82dec10/frameset.htm
    http://www.sap-basis-abap.com/wf/sap-business-workflow.htm
    https://forums.sdn.sap.com/click.jspa?searchID=791580&messageID=2857887
    https://forums.sdn.sap.com/click.jspa?searchID=791580&messageID=2855919
    https://forums.sdn.sap.com/click.jspa?searchID=791580&messageID=2735228
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMSTART/BCBMTWFMSTART.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMDEMO/BCBMTWFMDEMO.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMPM/BCBMTWFMPM.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    Debug a workflow.
    This has a step by step procedure :
    http://fuller.mit.edu/workflow/debugging.pdf
    www.erpgenie.com/sap/workflow/debugging.htm
    http://www.erpgenie.com/workflow/debugging.htm?2b5de440
    Workflow tutorials with step-by-step and with screenshots are available at
    http://www.****************/Tutorials/Workflow/Workflow.htm
    http://www.sapgenie.com/workflow/
    http://www.sap-img.com/workflow/sap-workflow.htm
    http://help.sap.com/saphelp_47x200/helpdata/en/3d/6a9b3c874da309e10000000a114027/frameset.htm
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    http://help.sap.com/saphelp_47x200/helpdata/en/4a/dac507002f11d295340000e82dec10/frameset.htm
    http://www.workflowing.com/id18.htm
    http://www.e-workflow.org/
    http://web.mit.edu/sapr3/dev/newdevstand.html
    http://www.sap-basis-abap.com/wf/sap-business-workflow.htm
    https://forums.sdn.sap.com/click.jspa?searchID=791580&messageID=2857887
    https://forums.sdn.sap.com/click.jspa?searchID=791580&messageID=2855919
    https://forums.sdn.sap.com/click.jspa?searchID=791580&messageID=2735228
    http://www.sapbrain.com/TUTORIALS/TECHNICAL/WORKFLOW_tutorial.html
    Regarding Work Flow   
    work flow scenarios.
    1. applying for a leave.
    2. approval process.
    3. material creation process.
    4. mainly work flow is for notification purpose.
    chk this links
    http://help.sap.com/saphelp_erp2005/helpdata/en/fb/135962457311d189440000e829fbbd/frameset.htm
    http://help.sap.com/saphelp_erp2005/helpdata/en/c5/e4a930453d11d189430000e829fbbd/frameset.htm
    Workflow
    http://www.sap-img.com/workflow/sap-workflow.htm
    http://help.sap.com/saphelp_47x200/helpdata/en/a5/172437130e0d09e10000009b38f839/frameset.htm
    For examples on WorkFlow...check the below link..
    http://help.sap.com/saphelp_47x200/helpdata/en/3d/6a9b3c874da309e10000000a114027/frameset.htm
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    http://help.sap.com/saphelp_47x200/helpdata/en/4a/dac507002f11d295340000e82dec10/frameset.htm
    http://www.workflowing.com/id18.htm
    http://www.e-workflow.org/
    http://web.mit.edu/sapr3/dev/newdevstand.html
    http://www.erpgenie.com/workflow/index.htm
    http://www.sap-basis-abap.com/wf/sap-business-workflow.htm
    http://www.insightcp.com/res_23.htm
    A good tutorial
    http://www.thespot4sap.com/articles/Invoice_Verification_Automation_Using_SAP_Workflow.asp
    http://www.sap-basis-abap.com/wf/sap-business-workflow.htm
    /people/alan.rickayzen/blog
    /people/jocelyn.dart/blog/2006/06/19/why-use-abap-oo-with-workflow
    a good book
    http://www.sap-press.com/product.cfm?account=&product=H950
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    http://help.sap.com/saphelp_47x200/helpdata/en/4a/dac507002f11d295340000e82dec10/frameset.htm
    http://www.sap-press.com/downloads/h950_preview.pdf
    Check the following PDF
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMSTART/BCBMTWFMSTART.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMDEMO/BCBMTWFMDEMO.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCBMTWFMPM/BCBMTWFMPM.pdf
    http://help.sap.com/printdocu/core/Print46c/en/data/pdf/PSWFL/PSWFL.pdf
    also seach the workflow forum: SAP Business Workflow
    Regards
    Anji

  • SCCM 2012 SP1 - SUP role removal or reinstall issue resolution

    Hello all,
    I just want to share a fix regarding SUP removal (re-install) issue.
    I think I found a bug  regarding SUP role removal/re-install.
    When I try to re-install secondary SUP on a site system, when I remove SUP via AdminUI – Administration – Site - Site Systems, it gets removed from the list but I get the following errors, which makes (re-)installation fail.
    Severity   
    Type        Site code
    Date / Time             
    System     Component             
    Message ID             
    Description
    Information              
    Milestone PS1        
    4/12/2013 10:28:09 PM          
    SMS02SS401.ICBCAGENT.NET             
    SMS_WSUS_CONTROL_MANAGER               
    1021        Site Component Manager detected that this component should be deinstalled from this site system. Site Component Manager will attempt to deinstall the component every 60 minutes. Site Component
    Manager will abort the deinstallation if it fails to succeed after 1440 minutes.
    Information              
    Audit        PS1        
    4/12/2013 10:27:58 PM          
    sms02ss401.icbcagent.net      
    Microsoft.ConfigurationManagement.exe  30038               
    User "ICBC\ll1v3" deleted the role of the Windows NT Server "\\SMS02SS401.ICBCAGENT.NET" as a Software update point in the site control file at site PS1.
    Error        
    Milestone PS1        
    4/12/2013 10:15:45 PM          
    SMS02SS401.ICBCAGENT.NET             
    SMS_WSUS_CONTROL_MANAGER      
    1020               
    Site Component Manager failed to reinstall this component on this site system.   
    Solution: Review the previous status messages to determine the exact reason for the failure. Site Component Manager will automatically retry the reinstallation in 60 minutes. To force Site Component Manager to immediately retry the reinstallation, stop
    and restart Site Component Manager using the Configuration Manager Service Manager.
    Error        
    Detail       PS1        
    4/12/2013 10:15:45 PM          
    SMS02SS401.ICBCAGENT.NET             
    SMS_WSUS_CONTROL_MANAGER      
    580               
    Could not delete the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\SMS_EXECUTIVE\Threads\SMS_WSUS_CONTROL_MANAGER"
    on computer SMS02SS401.ICBCAGENT.NET. The operating system reported error 997: Overlapped I/O operation is in progress.
    Information              
    Milestone PS1        
    4/12/2013 10:15:40 PM          
    SMS02SS401.ICBCAGENT.NET             
    SMS_WSUS_CONTROL_MANAGER               
    1018        Site Component Manager is reinstalling this component on this site system.
    Error        
    Detail       PS1        
    4/12/2013 9:14:39 PM            
    SMS02SS401.ICBCAGENT.NET             
    SMS_WSUS_CONTROL_MANAGER      
    580               
    Could not delete the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\SMS_EXECUTIVE\Threads\SMS_WSUS_CONTROL_MANAGER" on computer SMS02SS401.ICBCAGENT.NET. The operating system reported error 997: Overlapped
    I/O operation is in progress.
    In fact, the registry is under
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Components\SMS_EXECUTIVE\Threads\SMS_WSUS_CONTROL_MANAGER
    When I trigger uninstall via AdminUI, it failed to remove, thus it think that it is already there when I try to re-install it.
    The fix was to manually remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Components\SMS_EXECUTIVE\Threads\
    SMS_WSUS_CONTROL_MANAGER registry key then re-try.
    Thanks,
    Young-
    YPae

    Yes!!!  this worked for me.  I have SCCM set up with a number of untrusted forests with a firewall in between my SCCM servers and the untrusted forests.  The firewall went down and half of my site servers in the untrusted forests were giving
    the "operating system reported error 997: Overlapped I/O operation is in progress" on a number of their components. Finally found this, deleted the reg keys under "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Components\SMS_EXECUTIVE\Threads"
    and that allows SCCM to reinstall.

  • SOD Detour in Role Approval Workflow possible?

    Hello GRC Experts,
    we have implemented an Access Request Approval Workflow with a Detour Rule (GRAC_MSMP_DETOUR_SODVIOL).
    The second workflow we are working at is the Role Approval Workflow. Is it possible to use the SOD Detour Rule also in Role Approval Workflow? I didnt find the SOD Detour Rule in the MSMP Role Approval Workflow.
    We would like to implement a following Scenario:
    if the role contains an SOD the request should take Path 1 and if not Path 2.
    Is it in MSMP Standard possible or should we use BRF+ for creating a Detour Rule?
    Thanks,
    Best Regards
    Sabrina

    Hi Sabrina,
    For Access Request workflow, we generally use GRAC_MSMP_DETOUR_SODVIOL to implement routing rule(based on detour condition - risk found). Purpose of same (if I am not mistaken) is to through the request to another level of approver wherein mitigation monitor agent reviews the mitigation performed by role owner stage and approve/reject the request.
    But, when we create a role same is not the condition as we do not mitigate role level risk thus no need to go for mitigation monitor stage. May be you have some business scenario, if you can let us know will be gr8.
    For the rule ID, did you try adding the rule ID ?(you may already know, still would like to cross check with you).
    GRAC_MSMP_DETOUR_SODVIOL under list of rules for "
    Role Approval Workflow" In the screenshot you have shown, just click on ADD feed -
    Rule ID -GRAC_MSMP_DETOUR_SODVIOL.
    Rule description - same as Access request.
    Rule type - Function module based
    rule kind - routing rule.
    Add this and check if it works and let us know the result too.
    Regards,
    Nishant

  • Role Approval workflow and generation

    hi to all,
    can you just suggest me, what is the role approval workflow and tell brief about it
    give me any workflow
    thanks in advance
    Ramesh

    Hi Ramesh,
    Approval workflow is the way you can think of a process for approving a user to be created or assigned a group in the org. Example : User Create in HR -
    > Manager gets email notification -
    > Manager approves the user----
    > Division manager gets notified -
    > email sent to Helpdesk for a PC -
    > etc.
    Role Approval sounds like if the user is to be assigned a ROLE via an Approval Process before it gets created in LDAP. The provisioning will happan not just for the User but for the appropriate group according to the Role.
    Dev

  • Initiater for Role removal.

    Hi,
       I need some update/input w.r.t Role removal Initiator. While configuring the role removal is it possible to use the role status in the initiator?    If not how to identify this role is only for the role removal.
    Normally we use to put only one stage for Role removal. In the config, no where we are having automatic check for the request is only for the Role removal. So we have to trust that particular stage owners. As per the CUP automation check is it possible to validate this?
    Thanks in advance.
    Regards,
    Vasantha Kumar.

    Hi Justin
    I'm assuming you are involved in or victim of a security access review. I'm usually one of those security guys asking for role or transaction removal and you are the main contact in the business coordinating the changes.
    The process of remediation will possibly consist of checking which transactions are causing segregation of duties conflict, if they are used or not and removing one side of the conflict by removing an unused transaction.
    It shouldn't require the entire contents of a role to be removed - rather swapping role A for role B without a transaction or two.
    Removing transactions that aren't used can have more subtle implications which hopefully are found during UAT but is usually missed until used in anger. This what support is for after go live.
    Saying all that and depending on your time and skills, you could ask for access to the security person's test user in dev or qas where they are working to run transaction SUIM on transaction for user following the proposed changes and compare that to the actual access of the real affected user in prod. If you can get access to the informer tab in virsa you can use the standard simulation reports to also check the resulting conflicts which will help you talk to the business and advise on actions available. There should be role owners involved in all this as they have to owner the result: expect a request for these for CUP later on
    If you can retain control and approval of the (controlled) changes being made to users you will have a better understanding of what is happening, catch potential errors and mediate between security and the business - you have an important task!
    Ask for some basic training in standard SAP reports - the security team should be more than grateful for your input
    Crikey that was hard typing on an iPhone!
    Cheers
    Edited by: David Berry on Jan 11, 2011 8:17 PM

  • Can't Remove Workflow Manager 1.0 from "Programs and Features"

    I'm trying to Uninstall Workflow Manager 1.0 from "Programs and Features" in the Control Panel. It was part of a failed installation on a SharePoint Server. The Service Bus, Workflow Client, and Windows Fabric all installed fine but when I try
    to uninstall "Workflow Manager 1.0" Windows Server responds with "The computer is part of a farm. To uninstall, first leave the farm either using "Leave from Farm" option in Configuration Wizard or "Remove-WFHost" cmd-let
    in PowerShell."
    The Deployment Wizard "Leave the Farm" option is not working and I subsequently deleted it. And when I try to run "Remove-WFHost" PowerShell says "The term Remove-WFHost is not recognized. . ."
    The Workflow proxy in the Service Applications of the SharePoint installation has been deleted.
    Any idea how I can remove Workflow Manager 1.0?
    I need to get rid of Workflow Manager 1.0 so that I can start the installation again and hopefully get it installed correctly. . .
    Thanks,
    Kathryn
    Kathryn Birstein, Senior SharePoint Architect

    Hi Kathryn, 
    I had that issue some time ago and the the only way I found to get rid of it was: 
    Delete the Windows Registry entry KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Workflow Manager
    Try uninstalling it again.
    I hope it helps.
    Alex Rivera
    www.linkedin.com/in/alexmcts/en

  • Issue with Inactive Approver Role in Workflow definition

    Hi Experts,
    we are having issue with Inactive Approver Role in workflow definitions.
    we have created workflow for Master agreements and Projects. Phases and workflow are working fine.
    But the issue is when a programmatically added approver has completed the approval activity, collaborator role is not changing from approver role to Inactive Approver Role mentioned in workflow definition. For example, you might select Reviewer in Inactive Approver Role, Then Selected collaborator role to be given to programmatically added approvers when the approval activity is completed.
    This is functionality not happening when project or contract document approved and workflow completed in project and MA. we have followed all the standard functionality when we have created workflow. Please see screen shot for the same.
    Can anyone please tell me is there any functionality we missed it or do we need to write any script in xpdl or do we need to check anything with collaborator role or with security profiles.
    we have checked with other roles also same issue coming.
    This Reviewer is in active state and have Readonly profile. We don't have Pre script in this workflow because we are using standard approval.
    Thanks in advance!
    Lava

    Thanks gary for your helpful answer.
    As per your answer We have added the approver role in the prescript so that it gets added programmatically , still no luck.
    here is the script we wrote in prescript.
    import com.sap.eso.api.common.*;
    import com.sap.eso.api.projects.*;
    import com.sap.odp.api.workflow.*;
    import com.sap.odp.api.usermgmt.masterdata.*;
    import com.sap.eso.api.doc.collaboration.*;
    import com.sap.eso.api.doccommon.masterdata.*;
    import com.sap.eso.api.ibean.*;
    import com.sap.odp.api.ibean.*;
    import com.sap.eso.api.contracts.*;
    import com.sap.odp.api.doc.collaboration.*;
    collaboratorsCollection = doc.getCollectionMetadata("COLLABORATORS").get(doc);
    if (collaboratorsCollection.size() > 0)
       for (int i = collaboratorsCollection.size() - 1; i >= 0; --i)
            collaboratorsCollection_member = collaboratorsCollection.get(i);
            if (hasValue(collaboratorsCollection_member))
               collaboratorRole = collaboratorsCollection_member.getCollaboratorRole().getDisplayName();
                // Get approver of Role "Approver".
               if(collaboratorRole.equals("Approver"))
                    principal = collaboratorsCollection_member.getPrincipal();
    if (hasValue(principal))
         addApprover(principal);
    Do you have any other suggestions? or if you have any related code snippet please share with us.

  • Removing Workflow

    when I try to remove a SPD workflow from a list by the  http://portal/_layouts/15/RemWrkfl.aspx?List={xxxxxx.... )
     I get this error
    System.TimeoutException: The HTTP request has timed out after 20000 milliseconds. ---> System.Net.WebException: The request was aborted: The request was canceled.
       at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
       at Microsoft.Workflow.Client.HttpGetResponseAsyncResult`1.OnGotResponse(IAsyncResult result)
       --- End of inner exception stack trace ---
       at Microsoft.Workflow.Common.AsyncResult.End[TAsyncResult](IAsyncResult result)
       at Microsoft.Workflow.Client.Ht
    How do I remove a WF in SP 2013? - already tried via SPD . but can't delete them there 

    Hi,
    When I remove a SPD workflow from a list in my SharePoint 2013 environment, I didn’t met the error.
    I remove the SPD workflow: List Settings -> Workflow Settings -> Remove a workflow
    You can try to delete SharePoint workflow with PowerShell:
    http://blogs.msdn.com/b/guruketepalli/archive/2012/11/06/add-remove-sharepoint-workflows-thru-powershell.aspx
    Here is a same post with you,
    https://social.technet.microsoft.com/Forums/office/en-US/bbcfe930-dcad-4ceb-b941-537e6a3398b5/error-while-removing-workflow-association?forum=sharepointgeneral , The DNS server issue results to the issue.
    Here is a link about how to Setup DNS For SharePoint Site:http://sharepointdotnetwiki.iblogger.org/2009/12/dns-setup-in-sharepoint/, you can
    take a look at.
    Best Regards
    Lisa Chen
    Forum Support
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
    [email protected]

  • Approving a role removal

    Hi,
    I created a role and added an approver, I would like the same approver/approvers to be required to approve not only when the role is granted but also when the role is removed from a user, what is the easiest way to implement this?
    Thanks in advance

    Hi,
    thanks for your reply, I thought about that too but the remove button is pressed before the save, so the admin removing the role can still cancel the action.
    Any other idea? My idea is to create a subprocess called "approve removal" where I select the approvers and then call the native "approval" process (here though I still need to figure out the parameters values); once this is done I will add the subprocess to the "create user" and "update user" workflows (cloning and renaming them)
    Thanks
    Sergio

  • ROLES IN WORKFLOW

    how to find the linkage between workflow, tasks with roles.
    In workflow, mostly all the tasks and workflow template are assigned to Roles. So, based on the roles assigned to users, The respective set of workflow are available to each users. so, how to find that each roles have set of workflows and tasks assigned to it?? is there any table or transactions for it. (for eg : like event linkage with tasks and workflows)

    Hi,
    One slight point that I'd make is to insert the word "can" - they can exist for a defined period of time, then they are removed from the tables using the purge program.
    Setting an expiration date is completely optional, so you can keep your ad-hoc roles for as long as you want to - I know a number of clients that choose never to purge their ad-hoc roles.
    As you say, though, if you need to notify someone who isn't in the directory service as standard, then you need an ad-hoc role.
    HTH,
    Matt
    WorkflowFAQ.com - the ONLY independent resource for Oracle Workflow development
    Alpha review chapters from my book "Developing With Oracle Workflow" are available via my website http://www.workflowfaq.com
    Have you read the blog at http://www.workflowfaq.com/blog ?
    WorkflowFAQ support forum: http://forum.workflowfaq.com

  • Adhoc roles in workflow

    Can someone please tell me why we should create adhoc roles? I thought if the user has his fnduser name and an email address in fnd_user table, then he/she gets the notification.
    Thanks
    Jim

    Hi,
    One slight point that I'd make is to insert the word "can" - they can exist for a defined period of time, then they are removed from the tables using the purge program.
    Setting an expiration date is completely optional, so you can keep your ad-hoc roles for as long as you want to - I know a number of clients that choose never to purge their ad-hoc roles.
    As you say, though, if you need to notify someone who isn't in the directory service as standard, then you need an ad-hoc role.
    HTH,
    Matt
    WorkflowFAQ.com - the ONLY independent resource for Oracle Workflow development
    Alpha review chapters from my book "Developing With Oracle Workflow" are available via my website http://www.workflowfaq.com
    Have you read the blog at http://www.workflowfaq.com/blog ?
    WorkflowFAQ support forum: http://forum.workflowfaq.com

Maybe you are looking for