Lock Inactive/Dormant users in SAP automatically

[Former Member]

Hi Guys,

• We have a requirement to find out a program/report which will lock the inactive dialog users if the user has not logged on for 90 days in the SAP system. This will be implemented in child system.

• Please advise if there is any standard program/report available in SAP to achieve this task or we need to go for a customized program.
• The restriction is only on the logon date/no. of days since last logon>=90, user lock currently=0 and user validity=Active user.

Thanks a lot and have a nice day!!

• Ravi Pinjani.

[Former Member]

Hi Ravi,

As far I know, there is no standard program for your requirement, you need to go for a customized report.

You can use the report RSUSR200 to get the list of inactive users, from this list you need to develop a BDC to deactivate the users. This BDC would be used to lock the users, change the user group, remove roles from the user.

You can then run this report in background on a periodic basis.

Regards,

Laxman

[Former Member]

Hi Laxman,

Thanks for the quick response.

Can you please advise what's the full form of BDC. Our requirement is to only change the user lock value from 0 to 64.

Any reference link for customized program.

What should be the frequency of execution for the customized program?

Thanks for your help

[Former Member]

Hi Ravi,

BDC stands for Batch Data Communication, BDC allows you to perform database updates in the background.

Please take help of ABAPer.

Frequency of this program should be daily so system will calculate inactive users and lock them on daily basis. Better to schedule this at night when the load is minimum on system.

Hope this helps.

BR,

Mangesh

[Former Member]

No need for a BDC. Look at ABAP function BAPI_USER_LOCK.

Steve.

[shivraj_singh2]

Ravi,

Please look into the profile parameter -

login/password_max_idle_productive -

Specifies the maximum period for which a productive password (a password chosen by the user) remains valid if it is not used. After this period has expired, the password can no longer be used for authentication. The user administrator can reactivate password-based logon by assigning a new initial password. Permissible values: 0 – 24,000 (unit: days); Default value 0, that is, the check is deactivated Available after SAP NetWeaver 6.40

Your objective of preventing users from logging after 90days of inactivity can be handled easily by setting the value to 90 for this parameter. I don't think you need to reinvent the wheel for this by creating ABAP reports etc.

Regards,

Shivraj Singh

[Former Member]

Hi

The parameter will not help as it will effect the SAP stnadard ids and ids in 000/001/066 clients where team does not login on daily basis.

Regards

Saurabh

[martin_voros]

Hi,

depending on release you could use security policies. This will allow you to have different password rules for different groups of users.

Cheers

[Bernhard_SAP]

Hi all,

there is a standard solution available since one year already, for everybody who has no own tool/process defined. Please use SAP note 1656965 to get more details!

b.rgds, Bernhard