User denied their activities in the system

[Former Member]

Dear expert,

One transaction posted in the system by an ID belongs to userA. But userA denied it.

UserA claimed that someone might have been using his ID and posted it.

How do we proof that the transaction was actually posted from userA's terminal ?

Thanks.

[Former Member]

only thing i can think of is to look in ST03N and see that the TRX was used by that uid on the exact same time the posting was done> see in the right tabel for posting details.

[Former Member]

is there any log can show me the trx the user is posting and from which terminal ?

i know STAD has the info, but this log is overwritten very fast, normally it can only keeps the info for 1 or 2 days.

[Former Member]

as mentioned ST03N

[Former Member]

if it was not activated then you will not be able to look into the past, for activation go to Sm19/20 etc.

[Former Member]

If you have security Audit log activated you can see which terminal posted a tx. If not then Aukes suggestion is a good one

[Former Member]

any guide on how to activate the security log ?

tq