11-07-2013 2:01 PM
Hi Team,
We have an issue like, in development system, the activity filed in B_USERSTAT object has 2 entries that is change and display.
But when i see in production, the same object has 4 entries, change, display, create/generate like that.
How is it happen, any idea ?
I have checked in SU21 for that object and the permissible values. it is showing only 2 in both Dev & production.
So what could be the issue ? kindly help.
In both systems, author is showing as SAP. how to find who changed this standard object ?
Thanks in advance,
Sankar.
11-07-2013 2:26 PM
Hi Sankar,
Did your SAP systems went through any upgrade recently?Compare the values in table : TACTZ w.r.t entries of B_USERSTAT. Do you see 01, 06 in both dev and prod? It might be there are some old role which are still showing the old values, you might try generating the roles in dev and push the transport to production and see if it corrects the issue.
11-07-2013 2:26 PM
Hi Sankar,
Did your SAP systems went through any upgrade recently?Compare the values in table : TACTZ w.r.t entries of B_USERSTAT. Do you see 01, 06 in both dev and prod? It might be there are some old role which are still showing the old values, you might try generating the roles in dev and push the transport to production and see if it corrects the issue.
11-07-2013 5:47 PM
Hi Akshay,
Thanks a lot.
Through this table , i am seeing 01 & 06 only, in both Dev & Production.
But how did some roles remained with old values that to in production ?
If anybody changed that object means (by deleting permissible values to that field), it should effect all roles which contains this Object (B_USERSTAT) once the changes moved to produciton / activitaing this object.
And that to all our systems are in sync (roles and authorizations perspective)
So, is there anyway to find who changed the authorization object (SU21) last ?
Thanks,
Sankar.
11-07-2013 6:10 PM
Hi Sankar
Please see the audit logs SM20 and u can also get the report who accessed SU21 last by ST03N
I hope this gives you clue , to who has accessed to Su21 last
11-07-2013 6:33 PM
Hi Pavan,
Thanks.
Unfortunately, Audit logs are not configured in our landscape. And SU21 is used by all security team members. So this is some waht difficult to find who changed that object. Moreover we need the information about who changed the particulr object details (B_USERSTAT).
So, finding who used SU21 probably wont give the answer for my query.
Please correct me if i am wrong.
Thnaks,
Sankar.
11-07-2013 10:43 PM
Hi Sankar
Please use SUIM---change documents----For authorizations---
Put your auth object "B_USERSTAT"
See if that can help
Cheers
11-08-2013 6:18 AM
Thanks again Pavan.
Appreciate your help.
In the SUIM path, i am getting the change documents for the object who changed the values/entries in that fields, if i am not wrong.
But we need who removed the "Possible Values" to that object B_USERSTAT. Input entries it self not available for the activity field in that object.
This is the information i am requesting.
Thanks,
Sankar.
11-07-2013 2:43 PM
Hi,
Maybe someone changed the role in the production system? Via the SUIM -> change documents you can have a look at the changes that where made to the role in the system.
11-10-2013 4:52 AM
Hi Sankar,
This is to inform you that this object cannot be changed directly for any changes to be performed should be done system wide. Whoever has changed this has to change the system Change option from SE06 or SE03. Once the cross application or namespace changes are "Modifiable" then only this activity can be performed.
Moreover you can find the change details in the "log:system change option setting".
Hope this will help you to trace.
Regards,
Mohammed Imran
11-13-2013 12:24 PM
Thanks a lot Imran.
How ever, i am unable to find any details in SE03 log in system change option.
In our landscape, Basis team will do this change activity and some other team use this for any changes.
Kindly propose some other way.
Thanks,
Sankar.
11-13-2013 1:21 PM
Hi,
I think may be someone change this on development 4 to 2 object entries.
First it was 4 entries , transported the TR to production client.
Then change happens in development client.
You can check you quality client. I hope it contains 4 object.
Thanks
DEV