SU24 in ECC 6.0

Hello,
The interface for SU24 in ECC 6.0 is completely different from the previous version.
I was unable to find Check/Maintained anywhere.
There is a new Field called 'Proposal'.
I am confused. Could someone please please explain how SU24 in ECC 6.0 works.
Thanks.

Hi Goutam,
SU24 in ECC 6.0 is little different from the previous versions.The link below explains in detail.
http://help.sap.com/erp2005_ehp_03/helpdata/EN/52/67147d439b11d1896f0000e8322d00/frameset.htm

Similar Messages

Migrating SU24 to new system properly (ecc 5.0 to ecc 6.0)

Hello,
We are currently upgrading from ECC 5.0 to 6.0. As part of this cutover to the new system, I need to download SU24 properly from the 5.0 system and upload it to the new 6.0 environment because we heavily use SU24 for custom tcodes and to add additional auth objects to SAP delivered transactions.
The good thing is that SU24 has a download capability in the transaction, but the problem is that it gives you three option of downloads, in which all three can be selected.
1) SAP Data
2) Original Data
3) Customer Data
I know that we will obviously want to use the "Customer Data" due to our Ztcodes, but what is the difference between SAP Data and Original Data?
Our goal would be to download and upload only our custom changes (to both custom transactions and SAP transactions), but we do not want to overwrite any newly delivered SU24 updates that SAP may have implemented in ECC 6.0.
Has anyone ever done this or does anyone have an idea what these mean? Of course, the SAP help is useless on this issue.
I looked for such messages and read them here, I guess I still have some anxiety about ensuring that I download only what my company has maintained since our older 5.0 system went live. If I download all of the "Customer Data" option, I think that covers all of our custom transaction codes, but will that cover the auth objects associations to SAP delived tcodes we have made as well?
Also, It seems that I will have to use SU25 to activate. Any information of the best way to to do this our situation would be greatly appreciated!
Thanks,
Ryan

Thanks for responding.
The thing is that the person asking the questions does not give a hoot about points until they have an answer, and then only maybe... so forget about points.
Answering questions with random links or wild guesses in the hope that one of them scores a few points makes a big mess of the forums and renders the search almost useless when all these link-farms turn up.
Take a look at this thread for an extreme example => work flow
It is okay to post a link when there is a good reason for it, embedded within a discussion or to support an answer as a reference.
Please take a look at this thread for a more detailed discussion => How Far it is Good???
Now, back to the discussion...
I am not logged on, but if I remember correctly there is a function module which uses combinations of these three flags to read the SAP data (current SU22 data), the original data (SU22 data without the "update" flag - because in the past SAP rolled out some support pack notes to change SU22 and some customers maintained SU22 anyway instead of SU24...) and the customer data (which is what you are looking for). Additionally the function module parameter has a 4th flag for when nothing is checked, and then it downloads everything (?). The name of the function was something like SU22LISTVALUES but you should be able to find it via the Object Navigator from the download screen - Menu => System => Status => double-click the GUI Screen program. I remember there being lots of comments in the coding as well to help understand it.
But this was some time ago and on a 4.7 system when I had looked into it, so please also check how many entries are downloaded and compare these to your USOBT_C and USOBX_C tables before you do anything like an upload... - as the download might not deliver information you are expecting (assuming that you ran SU25 after making changes or made some changes to SU22 without importing them via support packages, etc).
Let us know what you find. I will take a look in the next days as well when I find a system with some data in it...
Cheers,
Julius

ME21N Material group level authorization is not working in ECC 6.0

Dear Security Experts,
We have created a role Z_ME21N with one Tcode ME21N. The role has to restrict users in the material group level.
For that, we added Authorization object M_MATE_WGR.
1. When we are trying to add field values for {M_MATE_WGR, BEGRU}, generally it should show me the list possible values to be used based on the MM configuration related to Material Authorization Group. We have correctly configured the authorization groups from V_TBRG for M_MATE_WGR. But itu2019s not showing any possible values.
2. However we are able to add values manually, but I guess these are not being considered during authorization check and our restriction on Authorization group level in ME21N is not working.
Test Scenario: We have manually added values 005,007,009,010,013 (which is pointing to specific material group) to BEGRU of M_MATE_WGR. We already assigned this Authorization Object to role Z_ME21N and this role has been assigned to u2018testuseru2019, but the authorization check with the M_MATE_WGR authorization group is not happening. It allows operations on all the material groups.
Anybody came accross same scenario?
SAP Prodcut version : ECC 6.0
Database : SQL Server 2005
Support pack level : 15
Please share your views, thanks in advance.
Regards,
Abu Sandeep

Dear All,
I got a reply just now from SAP regarding the same issue.
I coudnt understand what SAP and you are saying.
Dear Abu
*Apologies for the delay. This message has been turned on to application*
*area of MM from the Basis side just now.*
*Unfortunately, authorization object "M_MATE_WGR " is not checked*
*in the purchasing transactions (PR & PO), the system works as standard*
*functional designed.*
*Only the following objects are checked in PR/PO:*
*M_BEST_BSA Document Type in PO M_BANF_BSA Document Type in PR*
*M_BEST_EKG Purchasing Group in PO M_BANF_EKG Purchasing Group in PR*
*M_BEST_EKO Purchasing Org. in PO M_BANF_EKO Purchasing Org. in PR*
*M_BEST_WRK Plant in PO M_BANF_WRK Plant in PR*
*Setting in check/maintain on in SU24 only means that the profile*
*generator will propose the object when creating a user, however is*
*does not mean that M-MATE_WGR will be checked.*
*Please close this message by pressing the confirm button at your*
*earliest convenience.*
*Many thanks in advance for your understanding.*
So, how can I resolve this problem? John, are you sure that, you implemented this successfully?
SAP says, this cant be done.
Regards,
Abu Sandeep.

Upgrade to ECC 6.0 from 4.6C

I have been researching on the forums and I am following all the information I've found yet I still have one question.
We are upgrading our landscape from 4.6C to ECC 6.0 I just took this job and in the past the company did not transport new roles as they were created. They were created in PRD. DEV and QAS are upgraded to ECC6 now. I went to SU25 in DEV to go through steps 2 and 3. None of our roles are there so there wasn't anything to do. What I did was a massdownload of all roles from PRD and upload to DEV so that I could transport the changes to QAS and let everyone start testing. After uploading all roles into DEV, I went back to SU25, I did step 2A, & 2B says I do not need to maintain the transactions. 2C has almost all roles with a green status light, yet if I click on each role there are unmaintained and new authorization objects in all of them. I can go in one at a time and maintain them. However, if I am reading this correctly, in step 3 the values I maintain will not be transported. Is this correct? Am I going about this the correct way?
Michael

That's a tricky one...
Some ideas:
Was SU25 step 1 ever performed in DEV?
What you need to do before 2A is sync the SU24 data backwards as well, as that has probably been maintained in PROD as well. Also check how reliable the PROD SU24 data is and how many "changed" or "manually" or "inactive" auths there are.
2B I suspect might have problems from the upload into an upgraded system, particularly if you generate profiles for a transaction which does not exist anymore. Check the menu (and standard S_TCODE auths) whether everything you uploaded is there. Also consider running 2D first in a system copy to test your PROD roles.... Additional recommendation: see [SAP Note 991377|https://service.sap.com/sap/support/notes/991377]
If you are lucky, then they made a science out of SU24 directly in PROD and you can re-use that.
Good luck,
Julius
Edited by: Julius Bussche on Aug 4, 2009 9:10 PM

Issues in ECC 6.0 upgrade

Hello,
We are doing an upgrade from SAP 4.7 to ECC 6.0. In step 2C of SU25 we get a large number of roles in "RED". How do we identify if any additions or changes have happened to these roles. Please help
Many thanks
Vijaya

Hello Vijayalakshmi,
pls use the search function in this forum (for instance <SU25> returns 11 hits, for instance this one: https://forums.sdn.sap.com/click.jspa?searchID=13818484&messageID=5409652
> How do we identify if any additions or changes have happened to these roles. Please help
>
Well, if the roles are listed in SU25/2c, then there have been changes to that roles. In normal cases the SU24 values for the contained transactions have been changed or the transactions themeselves got changed/removed/replaced.
The documentation for SU25 is quite good and gives some valuable information too.
I hope this gives you a starting point for your upgrade project.
Last tipp: it is not a good ideay, to skip SU25 after the upgrade. Sooner or later you will have to perform this task to avoid losts of reclamations regarding missing authorizations from your users.
b.rgds, Bernhard

RAR - SU24 Config Updates - Multiple Systems

I was in the process of updating the SU24 data within RAR and was wondering how GRC differentiates between a transaction that exists in multiple systems. Typically only technical transactions would exist across systems, but this may not always be the case.
I can't say with 100% certainty that a tcd that exists across systems will be maintained with the same SU24 data. Nor can I say that it "ALWAYS" should have the same SU24 data.
When you upload the SU24 data from multiple systems and the same tcd/auth object/auth values exist, will the values be overwritten as you upload the text files for each system? I'm assuming yes? If this is the case, you would have to be cautious to the order in which you upload the text files per system.
We use SRM, BI, PI, and ECC. Any comments would be appreciated.
Thanks,
Rich

yes the text files do not have the SID but when you upload those files in RAR you specify for which system you are uploding it. By selecting the system from drop down you tell GRC for which system the SU24 data is for.
Thank you,
Partha

FI13 - 'Check' value in SU24 appearing in PG

Hi Experts,
FI13 tcode has been included in a role. We find that auth. object S_TABU_DIS has 'CHECK" value in check indicator(SU24). But in PG S_TABU_DIS value is appearing with values 02,03 for the activity field.
My query is eventhough the value of auth. object S_TABU_DIS is maintained as check in SU24, how is it appearing in PG. Please provide me details of the logic behind it.
Version: SAP ECC 5.0
Thanks for your time in advance.
Regards,
Nagendran

Hi,
Transaction FI13 is a parameter transaction which calls transaction SM34, which is used to maintain tables. Object S_TABU_DIS is a checked (value yes) for SM34. Hence it is appearing in the role. Also that is the reason it is not showing any values in authorization group field. If you would like to use FI13, then you should have object S_TABU_DIS with below values
Activities: 02,03
Authorization group: VC
Please goto transaction SE93 and click on display. You can see the details for FI13 which has been using transaction SM34.
Regards,
Gowrinadh

RAR - Logical system - SU24 upload

Hi people,
We use different logical system to include several ECC production systems. To have actual data, I need to upload the SU24 data from the backend system to the RAR (Upload objects)
There I have only the possiblity to load the SU24 data against a physical system, not for a logical system.
What happens now, if I am going to create a new function for a logical system and in this logical system are different ECC system referenced and each of them have another maintained SU24 data for standard transactions? Which data will be lead and relevant (pultruded) for the new function? Is it only the last loaded SU24 file?
Thanks for your feedbacks.
Regards,
Martin

Hi Martin,
You can upload SU24 data against individual connected physical systems only and last loaded data only will reflect. Logical system is work as basket for all added physical systems and provides flexibility for future usage.
If you want to create a new function for logical system - While adding Action (Transaction) in new Function you can choose/specify the available systems or ALL.
Thanks,
Ramesh K

SAP Security Upgrade 4.6C to ECC 6.0

Hello Gurus,
we are upgrading our systems to ECC 6.0 from 4.6C.
in SU25 step, do i need to manually go into every role and find the differences in Field values ?
there are more than 2500 roles and its becoming tedious task.
Is there any easy or other procedure available for the same ?
Regards,
Chaitanya

There are many tricks you can use to shave a role upgrade down to about 2 day's work, but day 1 is during the implementation design way back when to consider upgrades much later on...
Just knowing that you have 18k roles and 2500 turned red in step 2a is not enough infos to give you any efficient advice (I am not talking about your time... ;-).
What is however obvious is that between 2a and 2c there is 2... ah...?!?! That is your next closest catalyst, but dont hit the "accept SAP data" button unless you have not done any changes in SU24!
Some other key figures for upgrades are:
- Number of roles with distinctly different menus.
- Number of changed auths which are not copies.
- Number of manual auths needing manual adjustments.
- Obsolete and disabled objects.
- Security patches for unnoticed missing auth-checks.
- Cut-over, development freeze and parallel maintenance time period.
Cheers,
Julius

Security Upgrade from 4.6C to ECC 6.0

We upgrade from 4.6C to ECC 6.0.
In the past we use SU24 to maintain authorization check.
Do I need to run the Step 1 in SU25? (initially filling customer tables)
Does this step overwrite everything by copy tables USOBT, USOBX to USOBT_C and USOBX_C ?
If I don't run this step 1, how can I get the new SAP default values from ECC 6.0?
Thanks in advance.

I found the answer, for upgrade, run step 2a to step 2d

Explanation of the functions of two buttons of the screen of trans. SU24

Hello,
We are at SAP ECC 6.0
Could someone please explain the functions of the two buttons : 'Check Indicator' & 'Proposal' in the screen reached after entering trans. SU24, then selecting for the 'Application' tab 'Transaction' for the 'Type of Application' box and a valid transaction code for the 'Transaction Code' box, then pressing F8, as the online help of sap.help.com seems to explain this screen of older releases, as per the URL :
<a href="http://help.sap.com/saphelp_erp2005/helpdata/EN/52/67147d439b11d1896f0000e8322d00/frameset.htm">http://help.sap.com/saphelp_erp2005/helpdata/EN/52/67147d439b11d1896f0000e8322d00/frameset.htm</a>
When click on the button 'Check Indicator', I get two options :
-     Check
-     Do Not Check
When I click on the button 'Proposal', I get three options :
-     Set Status "Yes"
-     Set Status "No"
-     Set Status "New/Unmaintained"
Thank you in advance.
Best regards.
Reda Khalifa
IT Department Almansour Automotive Group - Egypt

hai,
In ECC 6
'Check Ind' colum always display 'CHECK' only
'Proposal' colum 2 options are there one YES and NO
if you select YES the authorization object is added to your profile
if you select NO the authorization object is not added to your profile.
Thanks & Regards
Siva

Su24 Object and text upload.

Hello,
I have 2 systems as Physical systems and third system added as logical system.
ECC, HR and Logical as ( ECC + HR + ECC2 )
Rule sets work fine. as I uploaded the risks against the logical system.
The Su24 objects need to be uploaded against the Development and Production boxes. Which has not been uploaded for the last one year.
1. Su24 objects on ECC, HR and ECC2 have been modified.
I am planning to extract su24 text and Objects from all the 3 backend systems and up load against respective systems, once in RAR -development and once in RAR - production.
2. Upload of Su24 objects will append the actions/ permissions or will it over wright the present ones.
Please let me know if this is correct .
Thanks
Vidyar

Hi Srihari,
My first point ( totally 2 X 3 = 6 uploads. ) is it correct that I upload on both GRC DEV and PROD seperately against all the three systems.
I will do a full sync with the users, roles and profiles.
Thanks
Vidyar

Equivalent new tcodes in ECC 6.0

Hi
We have upgrade our system from 4.6C to ECC 6.0.
Can someone help us to find the new equivalent tcodes for the below tcodes in ECC 6.0.
SO80 - SAPfind: Free Text Retrieval Dialog
LD03 - Display Communication Document
SCUI - Communicate system status to SAP
We have gone thru solution browser, thru program where-used lists but could not find.
Any inputs on this will help
Thanks & Regards
Senthil

Generally a check against a users authorisation will take place when there is the ABAP statement AUTHORITY-CHECK in the code, along with the subsequent logic. Without this, you add what you like in SU24 but it won't make a difference.
If you want additional checks which are not coded in the program for your transaction then you need to modify the code. SAP provides user exits and enhancement points for this purpose - they let you put in your own validations in specific parts of programs without having to change standard code. If you want to include some additional checks then you need to speak to your functional consultant and development team to make the appropriate changes. Once these changes have been made and tested, you can update SU24.
As delivered by SAP SAP will often have some authorisation checks switched off for standard objects. You can see them in SU24 by status Do Not Check. You can often activate these checks by changing them to Check or Check Maintained (or proposal in recent versions)

SU24 custom value migration to a new system

We have set up an entirely new DEV-QA-PRD landscape for our Global environment. I need to transport all of our custom SU24 entries from our North America DEV system to our new Global DEV system. Both SAP EVV environments are ECC 6.0., so versioning will not be a problem.
Is there an easy way to gather the entries in one enviroment via transport and import into another?
Thanks for your comments in advance.
Ryan

There are also download and upload reports available for syncronizing the data beyond system and transport boundaries.
I would recommend using them, as they also draw a distinction between SAP data, customer data and original data (which you might have).
Cheers,
Julius

Error while deploying a PAR file from NWDS into an ECC.

Hi all,
I am getting this error while deploying a PAR file from NWDS into an ECC.
Operation Failed: Please make sure the server is running or check the log (sap-plugin.log) for
more detail.
My server is running properly
1 - Where is sap-plugin.log file? I don´t find it.
2 - Could there be another file with another name with information about the error?
3 - Is there another way to deploy the file directly from the ECC?
Regards,

Hi,
Just make sure you have maintained correct server setting to check the same open the NWDS and follow this path
Windows/ Prefereces / SAP Enterprise Portal
Check the following enteries
Alias
Host
Port
Login etc.
Regards,

SU24 in ECC 6.0

Similar Messages

Maybe you are looking for