Profile can not be changed in PFCG

[Former Member]

Dear Expert,

I want to remove one t-code from PFCG, after going thru user authorization (in change mode), we see that the S_TCODE object has 3 profiles, where 1 of profile is only in display mode and it can not be changed to change mode. The t-code want to be removed is there (display mode), how can we remove if it can not be changed to change mode? We can not just delete the profile since it contains thousand of t-codes.

Our suspicious is it is inheritance from 4.6c since we are now on ECC6.

Thanks in advance.

Kind Regards,

Rudi

[jurjen_heeck]

Have you tried removing this transaction from the role menu?

[former_member1061482]

The instance which is display mode should be for the t-codes that have been assigned through role menu.

So, for removing any t-code from such instances, you should remove them from Role Menu. The T-Code will automatically get removed from (display) corresponding instance of S_TCODE.

[Former Member]

Hello Jurjen and Hermant,

Thanks for your response, i just think that there's a way to change the display mode instead of removing it from the menu.

Anyway, i'll try to revoke it from role menu.

Kind Regards,

Rudi

[Former Member]

Hi,

I already removed the t-code but it still in the profile (display mode), is there another ways to resolve it?

Any helps would be appreciated.

Thanks and Regards,

Rudi

[Former Member]

hi,

In PFCG go to the Change Authorization Data and activate or deactivate there.

[Former Member]

Hi Rudi,

Firstly try finding the tcode in the roles menu again, sometimes tcodes are existing twice within the roles menu. Usually once tcode node is deleted from the roles menu, it disappears from the s_TCODE. But once you delete the tcode from roles menu, you need to generate the profile for the role once.

We had faced a similiar issue few months back & it was because someone had maintained the tcodes in the role manually in the authorization tab instead of entering it in the Roles menu.

The action I had taken was, I had entered all the tcodes present in the changeable instance through the roles menu. So, all the transactions were visible in only displayeable instance. And then deleted the remaining (changeable) instances.

And we had maintained tcodes in the roles through roles menu since then and faced no issues.

You can try this.

Regards,

Akshay

[Private_Member_119218]

1. Double-check the role menu - are you sure the trx is not listed there?

2. Display the authorization data and search (Ctrl + F) for auth. obj. S_TCODE with the trx in question as value - any hits?

3. If both of the above are false, check if the authorization profile is current, that is, was it generated from the current authorizations data? If it is not, the "Authorizations" tab in PFCG for this role should be marked with a yellow triangle.

4. If (3) was true, regenerate the profile either from within authorizations data in Change mode or using trx SUPC.

[Bernhard_SAP]

Hi,

there is another possibility, if the t-code is not contained in the menu anymore....

Check, if the t-code came into the tcd-field of S_TCODE by auth.-proposals from SU24!

It is quite simple to check that:

on the authorization-maintenance tab of the role: enable all icons through the menu:

Utilities->Settings...>Mark all checkboxes and save.

Then expand that Standard S_TCODE authorization and press the icon which looks like a mountain+sun. If you find your tcd-value there, you have identified, from which original t-code this value has been merged into the standard S_TCODE authorization.

2 possibilities now: remove this origignal t-code from the menu, or remove that su24-value form that original tcode in SU24. Than merge authorization data again in pfcg and the value is removed.

b.rgds, Bernhard

[Private_Member_119218]

Interesting.

I've never seen that happen. If it was possible to from one transaction to another through the menu I've always had to add authorizations for called trx manually.

Can you name any examples w/ SAP default SU24 values?

[jurjen_heeck]

> Can you name any examples w/ SAP default SU24 values?

A fairly recent thread about the same subject:

[Bernhard_SAP]

Hi,

of course, if you really want. But simply have a look at table USOBT_C, enter at selection field object=S_TCODE and Field=TCD. Then you will see....

For instance tcode SUIM (user information system), inserts

S_TCODE/TCD=

RSSCD100_PFCG

RSSCD100_PFCG_USER

RSUSR200

S_BCE_68001393

S_BCE_68001394

S_BCE_68001395

S_BCE_68001396

S_BCE_68001397

S_BCE_68001398

S_BCE_68001399

S_BCE_68001400

S_BCE_68001401

S_BCE_68001402

S_BCE_68001403

S_BCE_68001404

S_BCE_68001405

S_BCE_68001406

S_BCE_68001407

S_BCE_68001408

S_BCE_68001409

S_BCE_68001410

S_BCE_68001411

S_BCE_68001412

S_BCE_68001413

S_BCE_68001414

S_BCE_68001415

S_BCE_68001416

S_BCE_68001417

S_BCE_68001418

S_BCE_68001419

S_BCE_68001420

S_BCE_68001421

S_BCE_68001422

S_BCE_68001423

S_BCE_68001424

S_BCE_68001425

S_BCE_68001426

S_BCE_68001427

S_BCE_68001428

S_BCE_68001429

S_BCE_68001430

S_BCE_68001431

S_BCE_68001432

S_BCE_68001439

S_BCE_68001440

S_BCE_68001441

S_BCE_68001767

S_BCE_68001777

S_BCE_68002030

S_BCE_68002041

S_BCE_68002111

S_BIE_59000197

S_BIE_59000198

S_BIE_59000199

(in my 7.00 system).

b.rgds, Bernhard