How to Restrict access to roles in PFCG?

[Former Member]

Hihi,

Was wondering if anyone of you know if we can restrict the administrator access to certain roles in PFCG? Is there any values or objects that you can restrict to control the access?

Picture:

We have regional SAP administrator and Local Administrator. The company would like to restrict the access to local administrators, where they can only make changes to certain roles. They are able to vies the roles to see the Tcodes and objects but not able to change for those restricted roles.

Regional administrator is able to have full access.

Is there a way to control such restrictions? Appreciate any replies. Thank you!!

cheers

Edited by: SapGer on Feb 17, 2011 5:22 AM

[Former Member]

Well,

The first thing that comes to mind is reviewing the S_USER_* authorization objects. Spacifically the S_USER_TCD and the S_USER_PRO. You will have to review all those auth objects and you can limit role maintanence with those.

Hope that points you in the correct direction.

Kind Regards,

Paul

[Former Member]

You can use S_USER_AGR object to control who can chage the role.If you have a different naming conventions.

Hope this helps.

Edited by: Srinu Koveta on Feb 18, 2011 1:47 AM