Whats the risk of having SE37, SE38, SE80 in Production?

[Former Member]

I have users who have tcodes SE37, SE38 and SE80 in BW Production. Whats the risk of having these tcodes if they dont have developers key?

Thanks,

Chox

[Former Member]

Hi Chox,

These transactions mustn't be grant to anyone in production systems. Despite they cannot change the code, they can directly execute it, and that's the most important risk.

If they also have authorization S_DEVELOP ACTVT 02 they can also execute programs or function modules and they can "skip" the authority checks. The can create users or assign SAP_ALL to themselves without trace .Here an example: http://scn.sap.com/message/1974116#1974116

In production environments the should use the corresponding transactions!.

Re: Sensitive Transactions List for Production System

Cheers!

Diego.

[Former Member]

   Dear Diego,

  "If they also have authorization S_DEVELOP ACTVT 02 they can also execute programs or function modules and they can "skip" the authority checks. The can create users or assign SAP_ALL to themselves without trace"

How  user having t-codes->se37,se38,se80 can create user ID in sap environment.

  We must require SU01 to create SAP ID

[Former Member]

Sumit Jain wrote:
   Dear Diego,
  "If they also have authorization S_DEVELOP ACTVT 02 they can also execute programs or function modules and they can "skip" the authority checks. The can create users or assign SAP_ALL to themselves without trace" 
 How  user having t-codes->se37,se38,se80 can create user ID in sap environment.
  We must require SU01 to create SAP ID

What do you think sits behind SU01? Have you looked at OY27/28 etc?

Transactions are but one gateway to accessing functionality.  If you have the ability to access that functionality through other means then you can perform those activities (subject to suitable authorisation)

[Former Member]

Hi Diego,

Thanks for the answer. One of the users states that they need SE37 to validate code moves. Do you have know what alternative tcode they can use to achieve the same?

- Chox

[Former Member]

Hi Chox,

There's no need to validate code moves via SE37. You can just send her/him the transport request log.

Cheers,

Diego.