Post Installation Task after successful R/3 46c

Generally you need to :-

1. import profiles (default, instance, start) into SAP R3
1.1 add/modify instance parameters such as
rdisp/max_wp_run, abap/timeout,
zcsa/system_languages, and so on...

2. update the R3trans and tp tools with the last ones available on sapnet

3. configure TMS (systems,layer and routes).
You can do it with virtual systems if you have only one SAP system

4. update SPAM/SAINT

5. check via Tcde db02 (with refresh option) the available space for TS other
than SYSTEM TS.( for the others %used must be less than 90)
5.1 check to see critical objects (table/index)
5.2 extend (via sapdba tools -> option TS administration) all TS which
shown critical objectsfor example:
PSAPPOOLD + 200M
PSAPPOOLI + 100M ...
You can get necessary via Note 195446 (for language import) and Note 118823 (for client copy)
5.3 refresh again in db02 and check the %used space

6. import language other than the default (DE & EN) if necessary

7. Client copy

8. configure printer (SPAD)

9. create user

10. change system user password such as SAP* , DDIC, and so on ...

Error you might encounter at the end of client copy :-

"there is a window "change and transport system not configured" Status is cancelled.

To rectify the errors :-

You need to configure CTS via tcde STMS for your SAP system.

If it's your only sap system, then:
- configure it as domain controller: run Tcde STMS and accept the default proposed domain
controller which is your system
- define one or two virtual system (Menu overview-->system then Menu
SAP system-->create-->virtual system)
- Menu Environment --> transport routes then press F5 and Menu Edit
Transport layer to create a "Z" layer for example "ZDEV"
Create a transport route between your real sap system and the virtual system
by using the two layers: "Z" layer and "SAP" standard layer
- save and distribute the TMS configuration

That is the main action you have to do to setup CTS.

Problems with Multi-clients in one SAP Production instance

You are working on group of companies. They don't want to share any data between companies, simply no integration required, therefore mgt wants to have one client for one company that end up having multi-clients in prod instance. However, one of the SAP local guy told you not to continue with this lanscape.

Some of the potential problem of using multi-clients in one prod instance are:

1. problems affecting one client immediately affect all other clients.
an eg.: 1 client runs a job that fills up a tablespace or file-system.

2. a system problem (system crash) affects all clients immediately. e.g. an Oracle archive stuck will affect all clients.

3. programs/tables are client independant. Invidual customers cannot make changes to common programs/client without affecting the others.

4. Poorly written ABAP's will cause bad response throughout the SAP system, affecting all clients. I shudder to think of a situation where the programmer for 1 customer stuffs up and the other customers demand blood!

5. Taking all of this into account, your change management will turn into a NIGHTMARE! especially considering that each customer probably does no care about the other customers, so EVERY change of theirs is the most important one.

The above are some of the problems if you have multi-client in one SAP instance and there are many more arguments.

What is the best way to refresh QA from PRD?

How to make a system copy:

1. Take offline backup of both the server (source and target servers)

2. Verify the backup is successfully done.

3. Run the following command on source system.
a. Login as adm
b. svrmgrl
c. connect internal
d. alter database backup controlfile to trace;
e. exit;
f. Above command will generate a .trc file in /oracle/P01/saptrance/usertrace directory.
g. Copy the text from CREATE CONTROLFILE until the (;) and paste it in to any new .sql or controlfile.sql file.
h. Copy the controlfile.sql to target system.
i. Edit the file and replace the entire source SID to target SID.
j. Edit the reuse database command with the set database command

4. Copy the aft generated during the backup file from the source system to target system. (/oracle//sapbackup)
a. Change all the source to target .
b. Only don't change the backup volume name it must be target system .
c. Copy the above aft file name line from the source back.log to target.log file.

5. Shutdown the target server instance.

6. From this onwards all the command on the target system only.
a. Login as adm
b. run the SAPDBA
c. select J (Restore/Recovery)
d. select B (Full restore and recovery)
e. select A (Select backup of type)
f. Select the offline backup which you want to restore.
g. It will take some time to restore.
h. Once the database is restored login as adm and run the
i. svrmgrl
j. connect internal;
k. startup nomount (if the database is already mounted shutdown it using the shutdown command)
l. run the following command
m. @controlfile.sql (file name of the control file contains the CREATE CONTROLFILE statement)
n. After the run the above command it should give the "Statement Processed)
o. alter database open resetlogs p. shutdown
q. Start the database and SAP services using startup.

7. After this you have to reconfigure the STMS.

8. All the jobs also you have to reconfigure and reschedule.

9. Reconfigure all the printers.

10. If you want to change the Client number then use the local copy tool and remove the original client after successfully import to new client.

Proper way to delete a SAP client

Here goes:

1. log into the client to delete
2. go into SCC5 and delete client
3. log into another client and delete entry with SCC4
4. reorg database to recover database space.

Actually, if you check "on" the little "Delete Entry from T000" checkbox, you can skip step 3.

One other way of deleting a client which could give significant performance gain and save time is at OS level using - R3trans

To delete a client 200, you have to create a command file "del200" with following entries

Clientremove
Client = 200
Select *

Place the command file in /usr/sap/trans/bin

$ cd /usr/sap/trans/bin

$ R3trans –w -u 1

e.g $ R3trans -w del200.log -u 1 del200

To check the progress...

$ tail -f del200

How To Provide All Rights To The User

I have created user id & password by SU01 and menu, roles,authorization. I gave tcode se38 to the user in menu (by PFCG). Now when I tested by giving newly created user id password and when I enter the tcode : se38
and gave the program name and clicked display, it show "no display authorization", how to provide all rights to the user.

Following are the solutions for your queries:

1.) Transaction code SE38 is to created program in SAP, the programs are created or customized only by Developers/Abapers who have Developer Key and an Object key which are called as Acces key,without which no one can write a program in SAP,there is a option to write a program, i.e by login with the user SAPUSER which is default user of SAP which can create a program, because this reason you are not able to display the things with the Tcode-SE38.

2.) All rights to the user can be given by assigning SAP_ALL to the user in the profiles while creating the user.

3.) To assign SAP_ALL to the user, hit tcode SU01 to create a user.

a.) Give the name for the user and select create tab.

b.) First tab Address the Lat name only is mandatory else fill all the details.

c.) Select Logon tab in which Password is important, hence give the password.

d.) Select the Profile Tab-->Give SAP_ALL & SAP_NEW,and save the user.Now the user can access all the tcodes with SAP_ALL profile.

Creating New User With Authorizations

I want to create new user for SAP module. I am having user id as sap* (someone has said that this is super user id); when I login with this id and go to IMG for configurations. A message is displayed that I am not authorised to change the details with sap* user.

What is the procedure for creating new user which have all features define under SAP* user and which could allow me to make the configruations.

Creating new user with superuser authorizations.

1. Goto SU01 --
username : sapuser
|-->Create.

2. In default settings, give
:Mr
first name : sap
lastname : user

3. Goto next tab,
give initial password :1234
repeat password : 1234

4. Goto profiles.
type- sap_all (say enter)
sap_new (say enter)
Then save....
See the message in status bar, (user created successfully)

5. Login with the new user. change the password. now this user contains all superuser authorizations.

How To Compare The Roles

How to compare the roles where created or defined in two different systems?

For role comparision both the roles must be in the same system, in same client

Transaction code SUIM -> Comparision-> Roles

If the roles are in different system, then tranport the role into one of the system and do comparision. If no transport connection defined then, you can use the upload and download option in the PFCG

Steps for Role Comparing:

1. Run the t-code SUIM

2. Go To Comparison and select the option of roles

3. Click on Across systems option it will give option to select the sys name under Remote Comparison there enter the SYS ID between which system you want to do comparison and put the role name in compare role section then execute it will give you the result.

4. If there is any difference b/wn the t-codes it will b in red colour otherwisein yellow.

Query About Tcode PFCG

1. How to check the name of all users who has been authorised to use a particular transaction? I am trying to find through SUIM, but failing to find the name or total number of users of a particular t-code say SPRO.

2. I know that a particular transaction say SPRO is available in a particular role and I want to remove that t-code from that role. But I am unable to find that node through PFCG. If I am using the search for a t-code inside menu tab after putting the edit mode it is not coming in PFCG, but through SUIM its existence is coming in that role. That particular role contains a lot of t-code and reports, say about 2000.

1. Goto SUIM and select USER node, then select USERS BY COMPLEX SELECTION CRITERIA node then execute BY TRANSACTION AUTHORIZATION report then give the Tran. code and it will return you the number of users having that trans with relevatn details.

Follows these steps :-

- Go to SUIM .
- Choose Roles --> By Transaction assignment.
- Enter Transaction : "SPRO"
- Choose execute.
- Double click on a role in which you want to remove "SPRO" authorisation.
- Click on pen mark to change into change mode.
- Go to tab "Authorization"
- Choose change authorization data.
- Choose Utilities --> Technical names on .
- Choose --> cross application authorization objects-->
- Expand the selection for Object "s_tcode" , under the corresponding profile look the values maintained for "TCD" and remove value "SPRO" from the list to eliminate the authorization.
- Don't forget to regenerate profiles.

2. You should able to find this via menu tab otherwise try to do this in authorization tab --> change authorization data by search.

Frequently Asked Questions on Authorization

What is the difference between role and a profile?

Role and profile go hand in hand. Profile is bought in by a role. Role is used as a template, where you can add T-codes, reports..... Profile is one which gives the user authorization. When you create a role, a profile is automatically created.

What is the use of role templates?

User role templates are predefined avtivity groups in SAP consisting of tyransactions, reports and web addresses.

What is the different between single role & composite role?

A role is a container that collects the transaction and generates the associated profile. A composite reole is a container which can collect several different roles

What profile versions?

Profile versions are nothing but when u modify a profile paarameter through a RZ10 and generate a new profile is created with a different version and it is stored in the database.

Is it possible to change role template? How?

Yes, we can change a user role template. There are exactly three ways in which we can work with user role templates
- we can use it as they are delivered in sap
- we can modify them as per our needs through pfcg
- we can create them from scratch.
For all the above specified we have to use pfcg transaction to maintain them.

Personalization Tab Within PFCG

Please expalin the personalization tab within a role.

Personalization is a way to save information that could be common to users, I meant to a user role... E.g. you can create SAP queries and manage authorizations by user groups. Now this information can be stored in the personalization tab of the role. (I supposed that it is a way for SAP to address his ambiguity of its concept of user group and roles: is "usergroup" a grouping of people sharing the same access or is it the role who is the grouping of people sharing the same access?)

How to insert missing authorization? Ways?

su53 is the best transaction with which we can find the missing authorizations.and we can insert those missing authorization through pfcg.

Table of authorisation field settings

Is there a table for authorisations where I can quickly see the values entered in a group of fields?
In particular I am looking to find the field values for P_ORGIN across a number of authorisation profiles, without having to drill down on each profile and authorisation.

AGR_1251 will give you some reasonable info.

Table with deleted users

Someone has deleted users in our system, and I am eager to find out who. Is there a table where this is logged?

Debug or use RSUSR100 to find the infos.

Run transaction SUIM and down its Change documents.

How can I make T_Code SPRO Read Only

I have a requirement to make SPRO read only. As you know it has a tree like structure and to make it read only seems like impossible.

You cannot make SPRO 100% display only by ANY setting. The SCC4 option only turns configuration tables to not-modifyable but still allows the non-config delivery class tables (or those configured to be changeable) to be modifed. It does nothing for the tcodes that are NOT table maintenance and not controlled by S_TABU_DIS. These will still allow configuration. All the tcodes in the SPRO are in several tables CUST_ACTOBJ (spelling?) is one.

You only real option is to create a role with all the tcodes in them that are in the SPRO , remove the create and change to display ( generally by changing the last nunmer on the 4 digit tcodes to 3) and removing all the Create and change access in all the activities and allow only the display.

PFCG allows you to create a role from a SPRO project so the usermenu will come close to the SPRO menu, which your changes it will be display.

Mass Delete of Old Roles

How can i do a mass delete of the roles without deleing the new roles.

There is a SAP delivered report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then relase the transport and import them into all clients and systems.

It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS.

To used it, you need to tweak/debug & replace the code as it has a check that ensure it is deleting SAP delivered roles only. Once you get past that little bit, it works well.

How to Check Missing Authorisation for User

How to check the missing authorisation for the user not having the option "/nsu53 ?"

You can use the following procedures to determine which authorizations a user requires to carry out a transaction:

You can use Trace function, ST01, you can trace the user activity and from the log you can see the authorization missing.

Start an authorization trace using the ST01 transaction and carry out the transaction with a user who has full authorizations. On the basis of the trace, you can see which authorizations were checked.

This procedure generally works well. However, sometimes the result is very surprising because certain programs can and do ignore some authorization checks by using preliminary checks and buffered results. In such cases, these methods are not very effective. You can recognize these cases because certain fields of the corresponding programs are specified with * or DUMMY at some point of the authorization check.

Analyzing authorization problems in an unknown program

The most frequently used method to analyze authorization problems in an unknown program involves you setting the Debugger breakpoints to the AUTHORITY-CHECK and MESSAGE commands. Then execute the program and analyze its behavior.

Determining all the authorizations a user has for an authorization object

When troubleshooting, it is often helpful to find out all the authorizations a specified user has for a specific authorization object. A simple method of reading these authorizations as raw data from the user master record is to execute the GET_AUTH_VALUES function module in the SUSR function group. Use the SE37 transaction or SE80 in test mode to do so. The result table is not formatted for output, but is very compact and easy to understand for authorization experts.

Analyzing an authorization problem that occurs for only one user

It is often the case that a certain authorization problem occurs for only one specific user. This kind of authorization problem generally affects users with no Debugging authorization. If you want to assign a user Debugging authorization without changing the HR authorizations, you can add the S_A.DEVELOP authorization profile (if available) to the user’s authorization profiles. In production systems, note that changes such as these to authorizations enable users (with relevant knowledge of the development environment) to access any system data easily (especially in other clients).