UserID locked several times

[former_member125931]

Hi All,

I am facinf one problem,every week that to specifically Monday,some one using my USERID and PASSWORD using some one before I login and locking the userID,for a single attempt I m getting the message as so many failed attempts every time I am taking help of my BASIS consultant to unlock it,please any one tell me how to findout who was done this,is there any particular trnascation to fidout the system login and locked userID,my user Id using by me and one more guy,we too only users,but that guy saying he was not locked,please help me out...

Thanks and Regds,

Sree.

[former_member125931]

Hi All,

Thankyou for giving valuable in puts as of now we observed that its due to one of user forgot to loggoff system(sap) so its automatically after few hours userID going to lock.

[Former Member]

Sree,

that doesn't make a great deal of sense in all honesty. A user fogetting to log out results in a lockout ??

[former_member125931]

Good,

If it so how it was locking every monday early morning(1:30 PM) and next of holiday at same??

every week its happening at same time..

[Former Member]

I'm not sure.

But if I were in your position, I'd be checking rfc destinations (do you have any other systems that use rfc's to connect to this system?). If the lockout is repeatedly happening at the same time every monday, have you checked to see if there are any batch jobs scheduled for that time?

[Former Member]

What you should really do is follow your license agreement and do not share user IDs!

[former_member125931]

Thankyou for reply..

But the same problem even in Holidays other than sunday also,as u suggested I'LL check Is there any RFC connected to this system.

[Former Member]

Since you are sharing your ID with at least one other person, how can you know that it is not being shared with others? Not only is this poor security, it is a violation of your SAP License Agreement.

[Former Member]

Hi,

As far as I remember there is a file in /etc/security from there you can get the terminal details. You should have changed the password as soon as you came to know that it was compromised.

Regards

KVR

[former_member125931]

Hi,

Can u expalin bit

[Former Member]

Sree,

have you created any rfc's with your account as the login?

[Former Member]

Need check messages in SM21, you will see from what computer your USER id is locked. Regards.

[former_member125931]

HI,

ThankQ Sergo,here it is not showing terminal number completely,Is I need to do any settings for that,it termainl number 10.101.23.123,here it was showing 10.101.2

[Former Member]

Yes Sree, you are right .... only 8 symbols shows .... But in our case it shows not IP, the PC name ..... And usually 8 are fine .... I'm check the security trace =2 for work proc. but it does'nt shows terminal ... Try to speak for basis peoples about "Activating the Security Audit Log" sm19 and sm20 t-codes ...

It should help you with the decision of your problems,and after you find "hacker" you can revert back settings ... Regards.

[Former Member]

Hi,

you can get the details from the Tcode STAD.

Put the time interval of the log that you found from the sm21 log,after getting the information when you click on detail document you can find the exact terminal.

Thanks & Regads,

Satyabrat