ACS 5.3 RAR: Default User ID "SAP*" with lock 96 comming in SOD's

[Former Member]

We have a scenario where default used "SAP*" has started to come up in SOD recently. It has never in the past come up in SOD's. We checked the user "SAP*" is locked with lock code 96 and stripped out of all the standard profiles. We use a CUA system to provision to ECC systems. SAP* is locked in CUA as well as the ECC systems. Despite all this we are are still seeing the user in SOD at end user level. SAP* was unlocked for some security work last month and then locked with code 32, then 64 and now 96.

Any clues of the reasons as to why we see SAP* in SOD conflicts?  Any help would be appreciated..

[Former Member · Accepted solution]

Hi Naima,

RAR application addresses the locked users which have been locked with some specific lock codes

(64, 40, 32 and 20). If you want that some more lock codes should also be considered while performing risk analysis please follow the instructions provided in SAP Note:

1013217 - Compliance Calibrator - Lock Users Corrections

This will resolve your issue.

Best regards,

Smriti