how to find out which user has the permission to execute startsap ?

[Former Member]

Hi All

How do I find out which user has the permission to execute the startsap and stopsap? Do I control the permission on those script using windows standard authorization? For example: only allow certain user have the read and write permission?

Thank you.!

Vincent Lo

[Former Member]

Hi John and Brad,

Thanks for your reply. They are very helpful.

Vincent

[Former Member]

Well to me this is really weird question..

<b>noone un-authorized should have access to OS on your system</b>

If this is valid you do not need to solve problems who can and who cannot start/stop SAP, because if you want to prevent some users from shutting down the SAP you have really hard job to do - there are many ways how to kill the SAP (for example killing relevant process from task manager, killing of database, messing with services etc.) - yes, this is harmful way of stopping SAP, but we are talking about attack, right? I would contact some Windows specialist to help you disable all the ways how to harm the running SAP. But still after that - there are many files that can be modified/deleted so SAP will crash after restart - you need to protect them too, etc.

In case you take the first assumption as granted (and you really limit access to this server) you do not need to worry who can stop or start SAP - at the other hand it may be handy to be able to start/stop SAP from other users - for this you can run the stop/start script "under different user".

But to answer the question - to me this is question just of access control (but really never tried that myself):

<a href="http://technet2.microsoft.com/WindowsServer/en/library/c6413717-511e-42bd-bd81-82431afe4b2a1033.mspx">Permit or restrict access to a snap-in for a domain</a> (or see other related links down there on this page)

Please award points for useful answers.

Thanks

[brad_landry2]

Hi Vincent,

normally all users in the administrators group can star/stop the j2ee via sapconsole, but you should always use SIDadm.

Brad