How to back all user-is passwords on QAS prior to refresh from PROD?

[Former Member]

Hi,

Before refreshed qas from prod, we backed up passwords of all user-id on qas system and put them back after the refresh by the following 2 steps. This worked perfectly for us in the past.

1. Run SQL script to capture passwords by select bcode, bname & mandt from qas system.

2. Run SQL script to reset password from step #1: eg. update sapr3.usr02 set bcode='97EDA983B81FCFC0' where mandt = '100' and bname = 'BOZO' ;

After we upgraded to EHP2, the above method did work anymore on my last refresh. Notes: Table usr02 was over written by the upgrade with version 7.02 so no way to compare new fileds on usr02 to the old ones (on all my dev, qas & prod)

We have several CPIC user-id's using for RFC connections to other systems. If we can't backup the passwords then it will be painful to reset password manually for each user-id and their RFC connections (a lot of work!)

I don't think export the whole table usr02 & re-import will work since I don't how how integrated this table with other usr## tables.

I appreciated anyone know the better/safe way to back up SAP user-id passwords in NW7.0 EHP# system please share with me.

Thanks.

Mimosa

[Former Member · Accepted solution]

Hi Mimosa,

You can use client export with profile user master records. and later on after the restore you can perform client import in QAS.

Regards

Mallesh

[Former Member · Accepted solution]

Mallesh,

Thanks very much for your answer.

My system is BI with only 1 working client 100.

I looked at SCC8 & see the below and have some puzzles??

-select profile: SAP_USER (User Master Records and Authorization Profiles)

-tartget system: <should be QAS system> right? However, after I restore from Prod, will this be lost?

Could you share steps of client export with profile user master records?

Have you tried this and worked before?

Thanks.

Mimosa

[volker_borowski2 · Accepted solution]

Hi,

clientexport with SAP_USER works fine.

If QA system is CUA (central user admin-system) connected -> disconnect

Do clientexport on QA with SAP_USER

Refresh QA System either by DB COPY / RE-Install / Client transport (SAP_ALL) from source of your choice.

Be sure to process completely. esp. run SCC7 if you you refresh by clienttransport.

Re-Import the QA user export to the refreshed system (this is a STMS Transport import, you do not start it in SCC8)

Run SCC7 (for the SAP_USER import) after the User import.

Re-Connect to CUA if you did disconnect in the beginning

USR02 does no hold the new style passwords any more. The are stored in another table now (have forgotten where).

You can find out which table it is, if you do an sqltrace when changeing a user password in SU01.

Or peek into report RSUSR003 which checks the default passwords of DDIC, ....

Volker

[Former Member]

Hi,

Try using "bcode" and "passcode" values from USR02 table to update the password on db level (as per your earlier method...).

As mentioned by volker, client export/import using SAP_USER profile is recommended.

Regards.

Rajesh Narkhede

[Former Member]

Thanks very much both Volker & Rajesh for your responses!

I will try both methods on the next refresh. We refresh several systems and our ECC system took over 3 days to do client export with SAP_USER profile (due to its complex users integration) that's why we use SQL method. Other systems can use client export.

Have a good day!

Mimosa

[volker_borowski2]

3 days for a User export 😮

It should do in 10-20 Minutes.

There must be something wrong.

As none of the tables is so big, that it could run for days, there is surely a lock situation.

Do you have a 3rd party tool for User management?

If yes, you should file a call for them.

This is simply way to slow, and you should check what is causing this.

Volker