Transaction to list userswith SAP_ALL&SAP_NEW Authorisation

Question

Hi,
Can some one please tell me if there is a transaction by which we can find out the list of users that has the SAP_ALL and SAP_NEW authorisation profile assigned to it.
Thanks
Priya

Answer 1

Hi Frank,
There are ways of automating some of it if the assumption that change documents
are created holds true (meaning that the preventative measures of bypassing the
creation of change documents are implemented) and even better if an (ab)user
does not know about the control...
Here are some of them which I have seen: (actually one of them did see me first
One of the better solutions involved both an interrogation of user to profile
assignments (USR04) AND the change documents (USH04) => because the
profile might have been removed before the "current" detective control is
performed. For that (profiles or roles) there is a standard report called RSUSR100
to read the change documents.
Once identified, the available profiles of SAP_ALL and equivalents can be
automatically sent to you if you can get the system to create a job on an
hourly basis which submits report RSUSR100 for a "from -> to" period (like
from '31.12.9999' to 'sy-datum minus n days'). If it finds such a change document
or new existing entry in UST04, it fires an alert with details within the hour.
There are several different ways of doing this with very low effort, and in all
existent clients.... also without making the job visible in SM37, with a bit more
effort.
This would however be unlikely to detect that which you are refering to: What if
SAP_ALL is copied or the authorization is manually imported into a role which
the user already has? For that you would need to go looking in UST10 (the
assignment of authorizations to profiles) or ideally USR10; or USH10 for the
change documents. If you find &_SAP_ALL or equivalent authorizations in the
change documents or they do not match the profile names... then fire the same
alert as before. I cannot remember how this was done done (which report etc)
and do not have access to the system anymore.
That would however not pass all requirements for automated detective controls,
because someone may have changed the authorization values of those auths
which are already assigned via profiles which the user has... For that you would
need to go prying in USH12 to see whether anything changed. For the current
authorization, looking in UST12 is easier to understand than USR12; but they
should be the same. Note that this access would be instant so there is no
necessity (nor sense) in searching for change documents relating to the user,
only change documents for object <-> field <-> values which you know to be
equivalent to SAP_ALL.
Another approach is to use the SAP standard rules in tables USK* (search SAP
notes on it, and the report RSUSR008_009_NEW) to define critical authorizations
which cannot be assigned, or critical authorizations which cannot be combined
together. I have seen one solution which used it to prevent the assignment of the
authorizations from tcode SU01 etc. I also suspect that it is (more...) sustainable
and less maintenance work in the long run, than programming an own report or
buying an external tool (someone else's own report).
Cheers,
Julius