Removing Roles From Expired Users

[Former Member]

Hello All,

What is the easiest way to remove all roles from all acounts that have expired. I want to start implenting roles being removed from accounts once the employee leaves and we have expired their accounts. In the past when an employee leaves we have always expired the accounts but never removed the roles. When I go to USR02 I can get my list of thousands of expired accounts that we have but where can I remove all of their roles in one shot.

Also would it be beneficial for me to setup a User Group for Expired Accounts, if so why? (I read on a couple posts that others do this but not sure why).

Thank You,

Alex

[Former Member]

You can use the program PRGN_COMPRESS_TIMES. It has an option for test run too. This program deletes the expired role assignments if you check the selection option ""Remove Validity Periods That Have Already Expired".

Also check the note 865841if you run into any issues.

[jurjen_heeck]

> When I go to USR02 I can get my list of thousands of expired accounts that we have but where can I remove all of their roles in one shot.

If you have a look at table AGR_USERS and filter for your expired users you can see the role assignments with begin (FROM_DAT) and enddate (TO_DAT). That'll provide enough information to de-assign roles through transaction SU10. To automate this process with SU10 have a look at SECATT.

> Also would it be beneficial for me to setup a User Group for Expired Accounts, if so why? (I read on a couple posts that others do this but not sure why).

To find them. You can run reports based on user group membership. That's easier than searching on expiry date.

[Former Member]

Thank You

Edited by: Alex Williams on Apr 21, 2008 5:13 PM