Role Deletion

[Former Member]

Are we allowed to delete roles in production? These roles are those that nobody issues anymore, roles that should not have gone to production, and roles that were renamed for a much better role naming convention.

Also, what if in the case of the client still in the final preparation stage of the implementation but roles have already been moved to production? Can you still delete roles that you will not be needing?

What is the best practice in both cases?

Thanks in advance!

Edited by: Bliss IM on May 18, 2008 9:40 PM

[Former Member]

In both cases just transport the deletion of the role in development.

Create your transport containing the role in dev, delete the role & then release the transport. The role will be deleted as the tpt goes through the landscape

[Former Member]

Just to add to Alex....

Every company has there own Change Control procedures to be in good shape during Audits...you may want to cross check the procedures before you go ahead with deleting roles.

Thanks!

[Former Member]

Adding to Alex...

If you delete the roles in production and might forgot to delete from other systems in a landscape, then the systems will be out of sync.

Another problem of deleting roles in prod. is of audit issue..

So, roles should be deleted in development and before deleting it should be put in transport request. After deleting the roles, the transport request should be released to other systems.

Please correct me if I am wrong !!

[l_borsboom]

You also might consider downloading the role to a local file - as a way of archiving - before deleting the role. In this case you can always undo the deletion.

Deletion in Development has the following order:

- add role to transport request

- delete role

- release request

- transport request thrpughout the landscape

KR,

Lodewijk

[Bernhard_SAP]

.... for some cases it makes sense to be out of synch.....

I think for example about all the SAP*-draft roles, which should not be necessary to exist in PRD, as they are only drafts for own roles. Or roles for developers....

I think, the less roles exist in PRD, the better. The role administrators and also the auditors may be happy, if the don't have to check so many roles.

b.rgds, Bernhard

[former_member82556]

After you transport a role deletion, the role will still exist in the users position record (PO13). Is there any easy way to clean this up?

Found my answer: You can use RHCHECKRELATIONS (transaction S_PH0_48000117) to cleanup any inconsistancies.

Edited by: Salim Assaf on Dec 1, 2011 5:46 PM