10-08-2009 9:27 AM
I want do NOT allow a sap user to change / create ABAP programs on PRD system, without taking his sscr key. How do I do?
10-08-2009 9:37 AM
Client settings in SCC4 (should) protect this. Besides that, take a good look at objects S_ADMI_FCD and S_DEVELOP.
10-08-2009 9:37 AM
Check out the check/maintain objects associated with SE38 in SU24. ( e.g - S_PROGRAM) . By restricting all these objects you can put the necessary restriction as required.
10-08-2009 9:37 AM
Client settings in SCC4 (should) protect this. Besides that, take a good look at objects S_ADMI_FCD and S_DEVELOP.
10-08-2009 11:59 AM
Thanks for your help.
I looked in scc4 and found the following configuration:
Change and transports for client-specific objects:
"automatic recording of changes"
Cross-client changes:
"No changes to cross-client Customizing objects"
Protection: client copier and comparation tool:
"protection level 0"
catt and ecatt restrictions:
"ecatt and catt not allowed"
I want to do the following configuration:
Change and transports for client-specific objects:
no changes allowed
Cross-client changes:
no changes to repositoru and cross-lient customizing obj
Protection: client copier and comparation tool:
protection level1 : No overwriting
catt and ecatt restrictions:
eCATT and CATT not allowed
Do you think that would solve the problem that if I do this configuration ?
You think other problems occur if this configuration would make?
Thanks for help
10-08-2009 12:31 PM
> Do you think that would solve the problem that if I do this configuration ?
It should.
> You think other problems occur if this configuration would make?
It shouldn't.
Check this [SAPHelp page on client settings|http://help.sap.com/saphelp_nw70/helpdata/en/57/38de9b4eb711d182bf0000e829fbfe/frameset.htm].
Edit: This is the page: http://help.sap.com/saphelp_nw70/helpdata/en/57/38dea84eb711d182bf0000e829fbfe/frameset.htm
Edited by: Jurjen Heeck on Oct 8, 2009 1:38 PM
10-08-2009 12:55 PM
Ok sir.
I will configure the system and only if i have other problems will return. Until then I think the subject is closed.
Thank you very much for your help.
Good day.
10-08-2009 9:22 PM
Just a side note: If you only restrict the client settings for development and not the developer authorizations, then a semi-skilled developer will anyway create programs and do what ever they want, if they are inclined this way.
In honesty, if they have this inclination then they will probably have their own development environments installed already in which case they will not need much (or any...) authorizations either.
In some cases I have seen, you don't even need a user ID in the system to program in it if your config is suboptimal and you do not do code reviews.
Cheers,
Julius