User Lock Status - Inconsistent in SU01, SUIM & USR02 Table

[Former Member]

Hi Experts,

Please have a look at the attached screen shots. One User ID is showing different status (locked / unlocked) in different situations (Tables / T-codes). This is really weird.

As the SU01 screen shows, the user is definitely locked out in the system and can’t access the system. But while running active User Reports from SUIM / Table, it shows the same user as "Not Locked". In Table USR02 while checking the User lock status individually, it is showing ID is locked. However when I run a generic Table query to show me the list of users not locked (UFLAG = 0), the same user shows up in that list.

If any of you have faced the same issue earlier, please help me to get an explanation here.

To me it looks like a bug in SAP.

Regards,

Debajit

[Former Member]

Perhaps someone unlocked the user at 3:25 PM?

Otherwise it could also be that the table buffer is inconsistent (USR02 used to be buffered). Which release are you on?

If you change the user and save once in SU01, it should fix the problem. However you might want to check on this as it is possible that someone "tinkered" with the DB... A where-used-search from SE11 on USR02 should tell you if it is an ABAP program updating the table (and possibly bypassing the buffer).

Cheers,

Julius

[Former Member]

How did you manage to get your specific user in the first postion of the lists? Might it be possible, that there are two of them, one with a not visible sight at the beginning, who is not locked, and a normal one, who is locked?

[Former Member]

Hi.

It's weird.. fields like GLTGB, and TRDAT also do not match. Have you performed a system copy/client copy?https://service.sap.com/sap/support/notes/1401395

Otherwise, as Julius mentioned, someone is modifying the DB.

Cheers,

Diego.

[Former Member]

Hi Julius / Diego -

I am at the SAP Version SAP_BASIS (SAP Basis Component) Release 700 Level 0023.

You are correct that the System / Client was a copy of another Production system. Can that be an issue? I know that if I just unlock the ID and lock it again - the issue might get resolved. But the problem is this issue is now caught by Audit and they are questioning about the accuracy of SUIM reports we are providing since last few months. Hence we need to provide a valid reason for this issue.

I approached to SAP as well on this and they came back with the Note # 1695113.

I read the Note but it is not exactly the issue I am facing. Anyway will try to implement this note and see how it goes.

Thanks for your suggestions in this matter.

Hi Wolfrad,

If you refer the screen shots, it is the same User ID shown every where. I don't think the same User ID can appear twice in the SUIM / Table output report.

[Former Member]

Generally this happens when user is locked because of incorrect logon attempts and locked again by administrator. In this scenario SUIM doesn't show up the user is locked. Then unlock user and again lock then the user will be shown up in SUIM. I think always SU01 lock status and USR02 lock status will always be in sync.

[Former Member]

Hi Debajit,

you are right, there are not two records of the same key in the file USR02. But it my appear as if there are.

By the way, please let me know how you put the specific record of 1019252 to the top position of your SUIM-list.

[Former Member]

Thanks a lot Wolfrad for sharing your experience. The screen shot you have give in last post, is exactly the same issue in our system.

There were actually 2 User ids - One User ID 1019252 and another one with a Blank Space (" ") in front of the same ID 1019252. One of the ID was locked and the other was active.

But in SUIM or USR02 Table - when the user entry shows up - it does not show the front blank character. Only in SU01 when I searched with User IDs *1019252* - 2 entries shows up!.

Thanks a ton for your help in this matter!

[Former Member]

For a while there existed a problem with user names being entered as the ASCII codes of the  characters. When saving them to the database it is possible that two different user ID names can appear as the same characters in the user interfaces (SU01, SUIM reports, SE16 data browsers, etc).

See https://service.sap.com/sap/support/notes/1731549 

You can apply this note to prevent certain ASCII codes from being entered (such as empty spaces), but it does not retro-fix existing data entered.

In this specific case, one of the users is assigned to the group "CC" and the other is not.

On the selection screen of SU01, enter the user name and then subsequently enter the keys ALT + 0160. This will enter a blank space at the end of the user name. If you then display this user and the group is not "CC", then you know that the second ID infact is a different one than the first (from the perspective of the database) and is probably not being used anyway. The first one is the real one I would say.

Cheers,

Julius