Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Phantom Transaction Codes in Roles - AGR_1251 table

Former Member
0 Kudos

I am an IT auditor, working with a very experienced SAP administrator. In the AGR_1251 table, I can see transaction code PA30 assigned to a role that it shouldn't to be. When the SAP admin runs his reports of what is available in the role, the transaction code is not there.

Can anyone explain why this occurs? It appears the user cannot reach the transaction code, and I think the SAP Admin's report just shows the transaction codes that are available through the menu tree.

Also, is there a way for someone can access the transaction code (a workaround) without going through the menu tree? I have seen somewhere that for some transaction codes, it is possible to go to System>Status and then double click on Program.

Thanks for your help.

1 ACCEPTED SOLUTION

jurjen_heeck
Active Contributor
0 Kudos

> I think the SAP Admin's report just shows the transaction codes that are available through the menu tree.

That is a correct assumption. The report used probably looks in table AGR_TCODES, where the menu contents are stored.

> Also, is there a way for someone can access the transaction code (a workaround) without going through the menu tree? I have seen somewhere that for some transaction codes, it is possible to go to System>Status and then double click on Program.

The command box top left in the gui screen will allow users to start transactions for which they have authorization but that are not in the user menu. The menu is not authorization-relevant, the S_TCODE value in AGR_1251 is. The program route isn't always available. I believe it checks extra objects in newer ECC versions.

Both issues described are SAP standard behaviour.

1 REPLY 1

jurjen_heeck
Active Contributor
0 Kudos

> I think the SAP Admin's report just shows the transaction codes that are available through the menu tree.

That is a correct assumption. The report used probably looks in table AGR_TCODES, where the menu contents are stored.

> Also, is there a way for someone can access the transaction code (a workaround) without going through the menu tree? I have seen somewhere that for some transaction codes, it is possible to go to System>Status and then double click on Program.

The command box top left in the gui screen will allow users to start transactions for which they have authorization but that are not in the user menu. The menu is not authorization-relevant, the S_TCODE value in AGR_1251 is. The program route isn't always available. I believe it checks extra objects in newer ECC versions.

Both issues described are SAP standard behaviour.