.

Can we convert Authorization field to Org, field

A. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE or
ZPFCG_ORGFIELD_CREATE
Use SE38 or SA38 to run the above report.

Organizational level fields should only be created before you start setting up your
system. If you create organizational level fields later, you might have to do an impact
analysis. The authentication data may have to be postprocessed in roles.

The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into
an organizational level field.

In addition, all affected roles are analyzed and the authorization data is adjusted. The values of
the authorization field which is now to become the organizational level field are removed and
entered into the organizational level data of the role.
Note: Table for Org Element- USORG
Refer to Note 323817 for more detail.
Q. How many profiles can be assigned to any user master record.
A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile
assignments for users). This table contains both information on the change status of a user and
also the list of the profile names that were assigned to the user.
The field PROFS is used for saving the change flag (C = user was created, M = user was
changed), and the name of the profiles assigned to the user. The field is defined with a length
of 3750 characters. Since the first two characters are intended for the change flag, 3748
characters remain for the list of the profile names per user. Because of the maximum length of
12 characters per profile name, this results in a maximum number of 312 profiles per user.
Q. Can you add a composite role to another composite role?
A. No
Q. How to reset SAP* password from oracle database.
A. Logon to your database with orasid as user id and run this sql
delete from sapSID.usr02 where bname='SAP*' and mandt='XXX';
commit;
Where mandt is the client.
Now you can login to the client using sap* and password pass
Q. What is difference between role and profile.
A. A role act as container that collect transaction and generates the associated profile. The
profile generator (PFCG) in SAP System automatically generates the corresponding
authorization profile. Developer used to perform this step manually before PFCG was introduced
bySAP. Any maintenance of the generated profile should be done using PFCG.
Q. What is user buffer?
A. When a user logs on to the SAP R/3 System, a user buffer is built containing all
authorizations for that user. Each user has their own individual user buffer. For example, if user
Smith logs on to the system, his user buffer contains all authorizations of role
USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.
A user would fail an authorization check if:

The authorization object does not exist in the user buffer

The values checked by the application are not assigned to the authorization object in
the user buffer
The user buffer contains too many entries and has overflowed. The number of entries
in the user buffer can be controlled using the system profile parameter

auth/number_in_userbuffer.

Q. SAP Security T-codes

A. Frequently used security T-codes
SU01 Create/ Change User SU01 Create/ Change User
PFCG Maintain Roles
SU10 Mass Changes
SU01D Display User
SUIM Reports
ST01 Trace
SU53 Authorization analysis
Click here for all Security T-codes

End User
Transaction Code
Menu Path

Purpose

SU3

System --> User Profile--> Own

Data

Set address/defaults/parameters

SU53

System --> Utilities --> Display

Authorization Check

Display last authority check that

failed

SU56

Tools --> Administration --> Monitor Display user buffer

--> User Buffer

Role Administration
Transaction Code
Menu Path

Purpose

PFCG

Tools --> Administration --> User Maintain roles using the Profile
Maintenance --> Roles
Generator

PFUD

<none>

SUPC

Tools --> Administration --> User Mass Generation of Profiles

Maintenance --> Roles -->
Environment --> Mass Generation

User Administration

Compare user master in dialog.

This function can also be called in
the Profile Generator:
Environment --> Mass compare
The Job for user master
comparison is:
PFCG_TIME_DEPENDENCY (to
Release 4.0 RHAUTUP1)

Transaction Code
Menu Path

Purpose

SU01

Tools --> Administration --> User Maintain Users

Maintenance --> Users

SU01D

Tools --> Administration --> User Display Users

Maintenance --> Display Users

SU10

Tools --> Administration --> User User mass maintenance

Maintenance --> User Mass
Maintenance

SU02

Tools --> Administration --> User Manually create profiles

Maintenance --> Manual
Maintenance --> Edit Profiles
Manually

SU03

Tools --> Administration --> User Manually create authorizations

Maintenance --> Manual
Maintenance --> Edit
Authorizations Manually

Profile Generator Configuration

Transaction Code
Menu Path

Purpose

RZ10

Tools --> CCMS -->

Configuration --> Profile
Maintenance

Maintain system profile parameters.

(auth/no_check_in_some_cases= Y).

SU25

IMG Activity:
Enterprise IMG --> Basis
Components --> System
Administration --> Users and
Authorizations --> Maintain
authorizations and profiles
using Profile Generator -->
Work on SAP check indicators
and field values
Select: Copy SAP check IDs
and field values

Installation
1. Initial Customer Tables Fill
Upgrade
2a. Preparation: Compare with SAP
values
2b. Reconcile affected transactions
2c. Roles to be checked
2d. Display changed transaction
codes

SU24

Same as for SU25:

Select: Change Check
Indicators

Transport

Maintain Check Indicators

Maintain Templates

Transaction Code
Menu Path

Purpose

SCCL

Tools --> Administration -->

Administration --> Client
Administration --> Client Copy
--> Local Copy

Local client copy (within one system,

between different clients)

SCC9

Tools --> Administration -->

Administration --> Client
Administration --> Client Copy
--> Remote Copy

Remote Client Copy (between clients

in different systems) Data exchange
over a network (not files).

SCC8

Tools --> Administration -->

Administration --> Client
Administration --> Client
Transport --> Client Export

Client transport (between clients in

different systems) Data exchange
using a data export at operating
system level.

<none>

Tools --> Administration --> User Mass transport of roles

Maintenance --> Roles -->
Environment --> Mass Transport

<none>

Tools --> Administration --> User Upload/Download of Roles

Maintenance --> Roles --> Role
--> Upload/Download

SU25

Point 3.

Transport of Check indicators

STMS

Tools -->Administration -->

Transports --> Transport
Management System

Transport Management System

System configuration
Transaction Code

RZ10

Menu Path

Purpose

Tools --> CCMS -->

Configuration --> Profile
Maintenance

Maintain system profile parameters.

(auth/no_check_in_some_cases = Y).

RZ11

SM01

Description of system profile

parameters
Tools --> Administration -->
Administration --> Transaction
Code Administration

Authorization Object

Lock transaction codes from

execution

Transaction Code
Menu Path

Purpose

SU20

Tools --> ABAP Workbench --> List of authorization fields

Development --> Other Tools -->
Authorization Objects --> Fields

SU21

Tools --> ABAP Workbench --> List of authorization objects (Initial

Development --> Other Tools --> screen lists by object class)
Authorization Objects -->
Objects

Audit
Transaction Code
Menu Path

Purpose

SE84

Tools --> Administration --> User Information System for SAP R/3
Maintenance --> Information
Authorizations
System

SECR*

<none>

Audit Information System

Menu Path

Purpose

Table maintenance
Transaction Code

SM30
(Tables
V_BRG,
V_DDAT)

System --> Services --> Table

Create table authorization groups
Maintenance --> Extended Table (V_BRG)
Maintenance
Maintain assignments to tables
(V_DDAT)

Table Group
Transaction Code
Menu Path
SE43

Purpose

ABAP Workbench -->

Maintain (Display) Area Menus
Development --> Other Tools -->
Area Menus
Common Transaction Codes for Basis Administration

AL01
SAP Alert Monitor

SE14

Utilities for Dictionary

Tables

SSM0

Menu
Maintenance and
Test

AL02

Database Alert Monitor SE15

ABAB/4 Repository Info SSM1

System

SAP and
Company Menu
administration

AL03

Operating System Alert SE30

Monitor

ABAP/4 Run time

Analysis

ST01

System Trace

AL04

Monitor Call Distribution SE38

ABAP/4 Editor

ST02

Setup/Tune
Buffers

AL05

Monitor Current
Workload

SE54

Generate Table View

ST03

Performance
SAP statistics,
Workload

AL06

Performance:
Upload/Download

SE61

R/3 Documentation

ST04

Select Database
Activities

AL07

Early Watch Report

SE80

ABAP/4 Development
Workbench

ST05

SQL Trace

AL08

Users Logged On

SE91

Maintain Messages

ST06

Operating
System Monitor

AL10

Download to Early
Watch

SE92

Maintain System Log

Messages

ST07

Application
Monitor

AL11

Directories

SE93

Maintain Transaction
Codes

ST08

Network Monitor

AL12

Display Table Buffer

(Exp session)

SH01

Online Help: F1 Help

Server

ST09

Network Alert
Monitor

AL13

Display Shared Memory SH03

(Expert mode)

Call Extended Help

ST10

Table Call
Statistics

AL15

Customize SAPOSCOL SICK

destination

Installation Check

ST11

Display
Developer Traces

AL18

Local File System

Monitor

SLDB

Logical Databases (Tree ST12

Structure)

Application
Monitor

AL19

Remote File System

Monitor

SLW4

Translation: Application ST14

Hierarchy

Application
Analysis

AL20

Early Watch Data

Collector List

SM01

Lock Transactions

ST22

ABAP/4 Runtime
Error Analysis

DB01

Analyze Exclusive Lock SM02

Waits

System Messages

STAT

Local Transaction
Statistics

DB02

Analyze Tables and

Indexes

DB03

SM04

User Overview

STDR

TADIR
Consistency
Check

Parameter Changes in SM12

DB

Display and Delete

Locks

STUN

Performance
Monitor Menu

DB11

Early Watch Profile

Maintenance

SM13

Display Upgrade
Records

SU01

Maintain User
Records

DB12

Overview of Backup
Logs

SM21

System Log

SU02

Maintain
Authorization
Profiles

DB13

Database
SM31
Administration Calendar

Table Maintenance

SU03

Maintain
Authorizations

DB14

Show DBA Action Logs SM35

Batch Input Monitoring SU10

Mass Changes to
User Master
Records

PFCG

Profile Generator
Activity Groups

SM36

Background Job
Scheduler

SU12

Mass Changes to
User Master
Records

RZ01

Job Scheduling Monitor SM37

Background Job
Overview

SU20

Maintain
Authorization
Fields

RZ02

Network Graphics for

SAP Instances

SM38

Queue Maintenance
Transaction

SU21

Maintain
Authorization
Objects

RZ03

Presentation, Control
SAP Instances

SM39

Job Analysis

SU22

Auth Objects
Usage in
Transactions

RZ04

Maintain SAP Instances SM50

Workprocess Overview SU24

Maintain Profile
Generator Tables

RZ06

Alert Thresholds
Maintenance

SM51

List of SAP Servers

SU25

Copy SAP to
Customer Prof
Gen Tables

RZ08

SAP Alert Monitor

SM63

Display/Maintain
Operation Mode Sets

SU30

Overall
Authorization
Checks

RZ10

Maintenance of Profile SM64

Parameters

Release of an Event

SU50

Maintain User
Defaults

RZ11

Profile Parameters

SM65

Background Processing SU51

Analysis Tool

Maintain User
Address

SAR

Maintain Transaction
Codes

SM66

System-wide Work
Process Overview

SU52

Maintain User
Parameters

SARA

Archive Management

SM67

Job Scheduling

SU53

Analyze
Authorization
Error

SCAT

Computer Aided Test

Tool

SM68

Job Administration

SU56

Display list of
User
Authorizations

SCC0

Client Copy

SMGW Gateway Monitor

SVER

ABAP/4
Verification

SCU3

Table History

SMLG Logon Groups

SVMC Start View

Maintenance with
Memory

SD11

Data Modeler

SMX

Display Own Jobs

SWT0 Configure
Workflow Trace

SDBE

Matchcode Objects
(test)

SOFF

SAPoffice: Area Menu

SWU8 Technical Trace

On/Off

SE01

Transports and
Correction System

SP00

Spool and Related

Areas

SWU9 Display Technical

Trace

SE02

Environment Analyzer

SP01

Output Controller

SWUD Diagnostic Tools

SE03

Transport Utilities

SP11

TemSe Directory

SWUE Initiate Event

SE07

Transport System
Status Display

SP12

TemSe Administration

SWUF Workflow Monitor

SE09

Workbench Organizer

SPIT

Output Controller

SWUH Test Method

SE10

Customizer Organizer

SPAD

Spool Administration

SWWD Switch on Work

Item Error
Monitoring

SE11

ABAP/4 Dictionary
Maintenance

SPAM SAP Patch Manager

SYNT

Display Syntax
Trace Output

SE12

ABAP/4 Dictionary
Display

SPAT

TU01

Call Statistics

Spool Administration test

SE13

Maintain Technical
Settings (Tables)

SPDD Display Modified DDIC TU02

objects

Active Instance
Profile
parameters

Q List few security Tables

Click here for security tables

Q How to create users?

Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an
initial password for that user on the Logon data tab. All other data is optional. Click here for
turotial on creating sap user id
Q What is the difference between USOBX_C and USOBT_C?
The table USOBX_C defines which authorization checks are to be performed within a
transaction and which not (despite authority-check command programmed ). This table also
determines which authorization checks are maintained in the Profile Generator.
The table USOBT_C defines for each transaction and for each authorization object which
default values an authorization created from the authorization object should have in the Profile
Generator.

Q What authorization are required to create and maintain user master records?
The following authorization objects are required to create and maintain user master records:
S_USER_GRP: User Master Maintenance: Assign user groups

S_USER_PRO: User Master Maintenance: Assign authorization profile

S_USER_AUT: User Master Maintenance: Create and maintain authorizations

Q List R/3 User Types

1.
2.
3.
4.

Dialog users are used for individual user. Check for expired/initial passwords Possible
to change your own password. Check for multiple dialog logon
A Service user - Only user administrators can change the password. No check for
expired/initial passwords. Multiple logon permitted
System users are not capable of interaction and are used to perform certain system
activities, such as background processing, ALE, Workflow, and so on.
A Reference user is, like a System user, a general, non-personally related, user.
Additional authorizations can be assigned within the system using a reference user. A
reference user for additional rights can be assigned for every user in the Roles tab.

Q What is a derived role?

Derived roles refer to roles that already exist. The derived roles inherit the menu
structure and the functions included (transactions, reports, Web links, and so on) from
the role referenced. A role can only inherit menus and functions if no transaction codes
have been assigned to it before.
The higher-level role passes on its authorizations to the derived role as default values
which can be changed afterwards. Organizational level definitions are not passed on.
They must be created anew in the inheriting role. User assignments are not passed on
either.
Derived roles are an elegant way of maintaining roles that do not differ in their
functionality (identical menus and identical transactions) but have different
characteristics with regard to the organizational level. Follow this link for more info

Q What is a composite role?

A composite role is a container which can collect several different roles. For reasons of
clarity, it does not make sense and is therefore not allowed to add composite roles to
composite roles. Composite roles are also called roles.
Composite roles do not contain authorization data. If you want to change the
authorizations (that are represented by a composite role), you must maintain the data
for each role of the composite role.
Creating composite roles makes sense if some of your employees need authorizations
from several roles. Instead of adding each user separately to each role required, you
can set up a composite role and assign the users to that group.
The users assigned to a composite role are automatically assigned to the
corresponding (elementary) roles during comparison. Follow the link to learn more

Q. What does the different color light mean in profile generator?

A.

Q. What are the different tabs in PFCG?

A.

Q What does user compare do?

If you are also using the role to generate authorization profiles, then you should note that the
generated profile is not entered in the user master record until the user master records have
been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on a
daily.

. Can we convert Authorization field to Org, field

A. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE or
ZPFCG_ORGFIELD_CREATE
Use SE38 or SA38 to run the above report.

Organizational level fields should only be created before you start setting up your system. If you
create organizational level fields later, you might have to do an impact analysis. The
authentication data may have to be postprocessed in roles.

The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an
organizational level field.

In addition, all affected roles are analyzed and the authorization data is adjusted. The values of the
authorization field which is now to become the organizational level field are removed and entered into
the organizational level data of the role.
Note: Table for Org Element- USORG
Refer to Note 323817 for more detail.
Q. How many profiles can be assigned to any user master record.
A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile assignments for
users). This table contains both information on the change status of a user and also the list of the profile
names that were assigned to the user.
The field PROFS is used for saving the change flag (C = user was created, M = user was changed), and
the name of the profiles assigned to the user. The field is defined with a length of 3750 characters. Since
the first two characters are intended for the change flag, 3748 characters remain for the list of the
profile names per user. Because of the maximum length of 12 characters per profile name, this results in
a maximum number of 312 profiles per user.
Q. Can you add a composite role to another composite role?
A. No
Q. How to reset SAP* password from oracle database.
A. Logon to your database with orasid as user id and run this sql
delete from sapSID.usr02 where bname='SAP*' and mandt='XXX';
commit;
Where mandt is the client.
Now you can login to the client using sap* and password pass

Q. What is difference between role and profile.

A. A role act as container that collect transaction and generates the associated profile. The profile
generator (PFCG) in SAP System automatically generates the corresponding authorization profile.
Developer used to perform this step manually before PFCG was introduced bySAP. Any maintenance of
the generated profile should be done using PFCG.
Q. What is user buffer?
A. When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that
user. Each user has their own individual user buffer. For example, if user Smith logs on to the system,
his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed
in transaction SU56.
A user would fail an authorization check if:

The authorization object does not exist in the user buffer

The values checked by the application are not assigned to the authorization object in the user
buffer
The user buffer contains too many entries and has overflowed. The number of entries in the
user buffer can be controlled using the system profile parameter
auth/number_in_userbuffer.

Q. How to find out all roles with T-code SU01?

A. You can use SUIM > Roles by complex criteria or RSUSR070 to find out this.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.
You can also get this information directly from table, if you have access to SE16 or SE16N. Execute
SE16N
Table
AGR_1251
Object
S_TCODE
VALUE (low) SU01

Q. How to find out all the users who got SU01 ?

A. You can use SUIM >User by complex criteria or (RSUSR002) to find this out.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.
Q. How to find out all the roles for one composite role or a selection of composite roles?
A. Execute SE16N
Table
AGR_AGRS
Composite roles

You can put multiple composite roles using the more button

Q. How to find out all the derived roles for one or more Master (Parent) roles?
A. Execute SE16N
Table
AGR_DEFINE

Use either agr_name field or Parent_agr field.

Q. How can I check all the Organization value for any role?
A. Execute SE16N
Table
AGR_1252

Role

Type in the role here and hit execute.

You can always download all the information to spreadsheet also using

Q. How do I restrict access to files through AL11?

A. First create an alias. Go to t-code AL11 > configure > create alias. Let say we are trying to restrict
alias DIR_TEMP which is /tmp. Open PFCG and assign t-code AL11, and change the authorization for
S_DATASET as mentioned below
Activity
33
Physical file name
/tmp/*
Program Name with Search Help
*
Q. How can I add one role to many users?
A. SU10. If you have less than 16 users then you can paste the userids.
If you have more than 16 users Click on Authorization data and click on

next to users and

upload from clipboard

.
Hit the change button and go to the role tab and add the roles to be assigned and hit save.
Q. What are the Best practices for locking expired users?
A. Lock the user. Remove all the roles and profiles assigned to the user. Move them to TERM User group.
Q. How can be the password rules enforced ?
A. Password rules can be enforced using profile parameter. Follow the link to learn more about the
profile parameter.
Q. How to remove duplicate roles with different start and end date from user master?
A. You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 865841 for more info.
Q. How come the users have authorization in PFCG, but user still complains with no
authorization?
A. Make sure the user master is compared. May be the there is a user buffer overflow
Also check the profile- Follow the instruction below.
SUIM > User by complex criteria.
Put the userid of user who is having issue.
Execute
Double click on the user id and expand the tree. Select the profile in question and see if the
authorization is correct or not. If not do the role reorg in PFCG and see if that helps.
Q. How can I have a display all roles.
A. Copy sap_all and open the role and change the activity to 03 and 08
Q. How can I find out all actvt in sap?
A. All possible activities (ACTVT) are stored in table TACT (transaction SM30), and also the valid
activities for each authorization object can be found in table TACTZ (transaction SE16).
Q. How to find all the users who got access to change and create users?
You can find all users who have access to create or change users using SUIM
Execute Transaction SUIM
Go to - Users by Complex Selection Criteria >>Users by Complex Selection Criteria or you could run
report RSUSR002 using SA38 or SE38
Fill in the screen as shown below, and execute the query. There are couple of other authorization
( S_USER_AGR, S_USER_GRP and S_USER_PRO) you might want to check as well.
On the other hand you could just give the user SU01D, which is display user master.

Q. What is SAP?
A. SAP is the name of the company founded in 1972 under the German name (Systems, Applications,
and Products in Data Processing) is the leading ERP (Enterprise Resource Planning) software package.
Q. Explain the concept of Business Content in SAP Business Information Warehouse?
A. Business Content is a pre-configured set of role and task-relevant information models based on
consistent Metadata in the SAP Business Information Warehouse. Business Content provides selected
roles within a company with the information they need to carry out their tasks. These information
models essentially contain roles, workbooks, queries, InfoSources, InfoCubes, key figures,
characteristics, update rules and extractors for SAP R/3, mySAP.com Business Applications and other
selected applications.
Q. What is IDES?
A. International Demonstration and Education System. A sample application provided for faster learning
and implementation.
Q. What is SAP R/3?
A. A third generation set of highly integrated software modules that performs common business function
based on multinational leading practice. Takes care of any enterprise however diverse in operation,
spread over the world. In R/3 system all the three servers like presentation, application server and
database server are located at different system.
Q. What are presentation, application and database servers in SAP R/3?
A. The application layer of an R/3 System is made up of the application servers and the message server.
Application programs in an R/3 System are run on application servers. The application servers
communicate with the presentation components, the database, and also with each other, using the
message server. All the data are stored in a centralized server. This server is called database server.

Q. What should be the approach for writing a BDC program?

A. Convert the legacy system data to a flat file and convert flat file into internal table. Transfer the flat
file into sap system called sap data transfer. Call transaction(Write the program explicitly) or create
sessions (sessions are created and processed ,if success data will transfer).
Q. What are the major benefits of reporting with BW over R/3?
Q. Would it be sufficient just to Web-enable R/3 Reports?
A. Performance Heavy reporting along with regular OLTP transactions can produce a lot of load both
on the R/3 and the database (cpu, memory, disks, etc). Just take a look at the load put on your system
during a month end, quarter end, or year-end now imagine that occurring even more frequently. Data
analysis BW uses a Data Warehouse and OLAP concepts for storing and analyzing data, where R/3
was designed for transaction processing. With a lot of work you can get the same analysis out of R/3 but
most likely would be easier from a BW.
Q. What is the difference between OLAP and Data Mining?
A. OLAP - On line Analytical processing is a reporting tool configured to understand your database
schema, composition facts and dimensions. By simple point-n-clicking, a user can run any number of
canned or user-designed reports without having to know anything of SQL or the schema. Because of that
prior configuration, the OLAP engine builds and executes the appropriate SQL. Mining is to build the
application to specifically look at detailed analyses, often algorithmic; even more often misappropriate
called reporting.
Q. What is Extended Star Schema and how did it emerge?
A. The Star Schema consists of the Dimension Tables and the Fact Table. The Master Data related tables
are kept in separate tables, which has reference to the characteristics in the dimension table(s). These
separate tables for master data is termed as the Extended Star Schema.
Q. Define Meta data, Master data and Transaction data
A. Meta Data: Data that describes the structure of data or MetaObjects is called Metadata. In other
words data about data is known as Meta Data. Master Data: Master data is data that remains unchanged
over a long period of time. It contains information that is always needed in the same way.
Characteristics can bear master data in BW. With master data you are dealing with attributes, texts or
hierarchies. Transaction data: Data relating to the day-to-day transactions is the Transaction data.
Q. What is Bex?
A. Bex stands for Business Explorer. Bex enables end user to locate reports, view reports, analyze
information and can execute queries. The queries in workbook can be saved to there respective roles in
the Bex browser. Bex has the following components: Bex Browser, Bex analyzer, Bex Map, Bex Web.
Q. What are variables?
A. Variables are parameters of a query that are set in the parameter query definition and are not filled
with values until the queries are inserted into workbooks. There are different types of variables which
are used in different application: Characteristics variables, Hierarchies and hierarchy node, Texts,
Formulas, Processing types, User entry/Default type, Replacement Path.
Q. What is AWB?. What is its purpose?
A. AWB stands for Administrator WorkBench. AWB is a tool for controlling, monitoring and
maintaining all the processes connected with data staging and processing in the business information
warehousing.
Q. What is the significance of ODS in BIW?
A. An ODS Object serves to store consolidated and debugged transaction data on a document level
(atomic level). It describes a consolidated dataset from one or more InfoSources. This dataset can be
analyzed with a BEx Query or InfoSet Query. The data of an ODS Object can be updated with a delta
update into InfoCubes and/or other ODS Objects in the same system or across systems. In contrast to
multi-dimensional data storage with InfoCubes, the data in ODS Objects is stored in transparent, flat
database tables.
Q. What is Extractor?
A. Extractors is a data retrieval mechanisms in the SAP source system. Which can fill the extract
structure of a data source with the data from the SAP source system datasets. The extractor may be
able to supply data to more fields than exist in the extract structure.

Q. How do I change the name of master / parent role keeping the name of derived/child role
same? I would like to keep the name of derived /child role same and also the profile
associated with the child roles.
A. First copy the master role using PFCG to a role with new name you wish to have. Then you have to
generate the role. Now open each derived role and delete the menu. Once the menus are removed it
will let you put new inheritance. You can put the name of the new master role you created. This will help
you keep the same derived role name and also the same profile name. Once the new roles are done you
can transport it. The transport automatically includes the Parent roles.
What is the difference between C (Check) and U (Unmaintained)?
A. Background:
When defining authorizations using Profile Generator, the table USOBX_C defines which authorization
checks should occur within a transaction and which authorization checks should be maintained in the PG.
You determine the authorization checks that can be maintained in the PG using Check Indicators. It is a
Check Table for Table USOBT_C.
In USOBX_C there are 4 Check Indicators.
CM (Check/Maintain)
- An authority check is carried out against this object.
- The PG creates an authorization for this object and field values are displayed for changing.
- Default values for this authorization can be maintained.
C (Check)
- An authority check is carried out against this object.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization.
N (No check)
- The authority check against this object is disabled.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization.
U (Unmaintained)
- No check indicator is set.
- An authority check is always carried out against this object.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization..
Q. What does user compare do?
A. Comparing the user master: This is basically updating profile information into user master record. So
that users are allowed to execute the transactions contained in the menu tree of their roles, their user
master record must contain the profile for the corresponding roles.
You can start the user compare process from within the Profile Generator (User tab and User compare
pushbutton). As a result of the comparison, the profile generated by the Profile Generator is entered into
the user master record. Never enter generated profiles directly into the user master record (using
transaction SU01, for example)! During the automatic user compare process (with report
pfcg_time_dependency, for example), generated profiles are removed from the user masters if they do
not belong to the roles that are assigned to the user.
If you assign roles to users for a limited period of time only, you must perform a comparison at the
beginning and at the end of the validity period. You are recommended to schedule the background job
pfcg_time_dependency in such cases
Q. Can wildcards be used in authorizations?
A. Authorization values may contain wildcards; however, the system ignores everything after the
wildcard. Therefore, A*B is the same as A*.
Q. What does the PFCG_TIME_DEPENDENCY clean up?
A. The 'PFCG_TIME_DEPENDENCY' background report only cleans up the profiles (that is, it does not
clean up the roles in the system). Alternatively, you may use transaction 'PFUD'.

Q. What happens to change documents when they are transported to the production system?
A. Change documents cannot be displayed in transaction 'SUIM' after they are transported to the
production system because we do not have the 'befor input' method for the transport. This means that if
changes are made, the 'USR10' table is filled with the current values and writes the old values to the
'USH10' table beforehand. The difference between both tables is then calculated and the value for the
change documents is determined as a result. However, this does not work when change documents are
transported to the production system. The 'USR10' table is automatically filled with the current values
for the transport and there is no option for filling the 'USH10' table in advance (for the history) because
we do not have a 'befor input' method to fill the 'USH10' table in advance for the transport.
Q. What is the difference between the table buffer and the user buffer?
A. The table buffers are in the shared memory. Buffering the tables increases performance when
accessing the data records contained in the table. Table buffers and table entries are ignored during
startup. A user buffer is a buffer from which the data of a user master record is loaded when the user
logs on. The user buffer has different setting options with regard to the 'auth/new_buffering' parameter.
Q. What does the Profile Generator do?
A. The Profile Generator creates roles. It is important that suitable user roles, and not profiles, are
entered manually in transaction 'SU01'. The system should enter the profiles for this user automatically.
Q. How many authorizations fit into a profile?
A. A maximum of 150 authorization fit into a profile. If the number of authorizations exceed this marker,
the Profile Generator will automatically create more profiles for the role. A profile name consists of
twelve (12) characters and the first ten (10) may be changed when generated for the first time.
Q. What authorization objects are needed for PFCG?
SAP Transport Authorization
To release Task
S_TRANSPRT
ACTVT=43, 03, 75
TTYPE=TASK
Other type:CLCP Client Transports
CUST Customizing Requests
DTRA Workbench Requests
MOVE Relocation transports
PATC Preliminary Corrections and Deliveries
PIEC Piece lists
TASK Tasks
TRAN Transport of copies
S_DATASET
PROGRAM=SAPLSTRF, SAPLSLOG
ACTVT=34
FILENAME=*
To release Customizing Requests
S_TRANSPRT
TTYPE=CUST
ACTVT=43, 03, 75
S_DATASET
PROGRAM=SAPLSCTS_RELEASE, SAPLSLOG, SAPLSTRF
ACTVT=33, 34
FILENAME=*
S_RFC
FC_TYPE=FUGR
RFC_NAME=STPA
ACTVT=16;

Authorization object needed for PFCG access

S_USER_AGR
ACT_GROUP= * (You can restrict by role, if proper naming convention is used)
ACTVT=01, 02, 03, 64 other fields below
01 Create or Generate
02 Change
03 Display
06 Delete
08 Display change documents
21 Transport
22 Enter, Include, Assign
36 Extended maintenance
59 Distribute
64 Generate
68 Model
78 Assign
79 Assign Role to Composite Role
DL Download
UL Upload
S_USER_GRP
CLASS=
ACTVT=22; 03
Other activity
01
Create or Generate
02
Change
03
Display
05
Lock
06
Delete
08
Display change documents
22
Enter, Include, Assign
24
Archive
68
Model
78
Assign
S_USER_TCD
TCD= * (Transaction in role)
S_USER_PRO
PROFILE= *
ACTVT=01, 06
Other activity
01
Create or Generate
02
Change
03
Display
06
Delete
07
Activate, generate
08
Display change documents
22
Enter, Include, Assign
24
Archive
S_TCODE
TCD=PFCG;
What is client 000 in SAP R/3?
Client 000 is defined as the SAP standard and the customer cannot change it. This client serves as a
copy template for the creation of further clients.

What are the different type of work process ?

The following work process in SAP R/3

Dialog (D): each dispatcher needs at least 2 dialog work processes (not shown above)
Spool (S): at least 1 per R/3 System (more than 1 per dispatcher allowed)
Update (V): at least 1 per R/3 System (more than 1 per dispatcher allowed)
Background (B): at least 2 per R/3 System (more than 1 per dispatcher allowed)
Enqueue (E): exactly 1 per R/3 System (only 1 E work process is required and allowed)

How do you start SAP R/3?

To start R/3, run the shell script startsap from the home directory of user <sid>adm.
startsap starts the saposcol process, which is the statistics collector for operating system resource data,
if it is not yet running.

startsap calls the script startdb, which starts the database if it is not already started.
startsap then starts the central instance.
The R/3 System administrator can start additional instances and application servers. To start the
instances independently of the database, use the script startsap.
startsap has the following options:
startsap r3:

Checks if the database is running; if it is, only the instance is started

startsap db:

Starts only the database

startsap all:

Default entry; starts both the database and the R/3 instance

In what sequence are profile parameter read?

R/3 processes read the appropriate parameters from a C source in the R/3 kernel

The default profile /usr/sap/<SID>/SYS/profile/DEFAULT.PFL is read; profile values already

defined in the C source are replaced with the values in the default profile
The instance profile /usr/sap/<SID>/SYS/profile/<SID>_<instance>_<hostname> is read;
profile values already defined in the default profile or in the C source are replaced with the
values defined in the instance profile
This procedure ensures that system parameter values reflect the instance profile and the values
in the default profile and the C source.

What are the step involved before stopping R/3 system?

Before stopping any R/3 system following steps are basic steps to be performed.

Before the R/3 System is stopped, the R/3 System administrator should check the:
Check if any background jobs from any application server are active or have been triggered
externally. Use transaction SM37
Check if the background work process BTC is running in any application server.
Check if any update records are open when the system is stopped, the records are rolled back
and set to status init. At startup, the records are processed again.
The administrator must decide whether to interrupt the jobs or wait until they are finished.
Give system users advance warning of the system shutdown. To create a system message, you
can use transaction SM02.
Before shutting down the system, use transaction SM04 to check whether users are still logged
on, and ask them to log off.
The R/3 System administrator and administrators of external systems should also inform one
another about data transfers between their respective systems.

How do you check the work process from UNIX?

Use the following commands.
To check all the work processes:
ps -ef | grep <SID> | grep dw

To check the message server:

ps -ef | grep <SID> | grep ms
To check the SAP OS collector:
ps -ef | grep sapos
How do you display the server name?
To display the server name, use transaction SM51. Information about the process types is also
displayed. For further information, select one of the instances and choose Processes. Alternatively, to
display the system processes, use transaction SM66.
How do you display all active users in your system?
To display the overview of all active users on the instance where you are logged on, use transaction
SM04. For a user overview of the whole system, call transaction AL08.
. What happens to locks when the enqueue server is restarted?
A. If they have not been saved to disk in the backup file, they will be lost. The locks that are inherited
by the update task when COMMIT WORK is executed after CALL FUNCTION .. IN UPDATE TASK are
saved to the disk. The locks are saved to disk when the update request becomes valid, that is, with the
COMMIT WORK. Each time the enqueue server is restarted, the lock entries saved on the disk are
reloaded to the lock table. A lock is saved to disk at the point at which the backup flag is set.

Q. The enqueue server is a single-point-of-failure in the SAP System. Can I guarantee high
availability for the Enqueue Server?
A. To guarantee this you must use the standalone Enqueue Server with the Replication Server. This is
described in the documentation Standalone Enqueue Server.
SAP note 524816 contains the prerequisites that must be fulfilled for using the standalone Enqueue
Servers with the Replication Server.
Q. Where is the lock table stored?
A. In the main memory (shared memory) of the enqueue server. All work processes on the enqueue
server has access to the table. External application servers execute their lock operations in the enqueue
process on the enqueue server. Communication in this case takes place via the relevant dispatchers and
the message server.
Q. Can locks exist directly after startup?
A. Yes, the saved locks, which were inherited by the update task, are reloaded to the lock table during
startup (see first question).
Q. How fast are lock operations?
A. In work processes on the enqueue server, a few 100 microseconds. In work processes of external
application servers you have to include network communications and process changes. Depending on
CPU and network load this amounts to a few milliseconds.
Q. What should I do first if a problem arises?
A. Use the diagnosis functions:
sm12 Extras Diagnosis and then
sm12 Extras Diagnosis in update
If a problem is reported, back up the trace files dev_w*, dev_disp, dev_eq* and check the
Syslog.
Q. The following message is displayed in the diagnosis details in SM12:
Lock management operation mode
Internal lock management in same process
What does this message mean and what are the other options?
A. "Internal lock management in same work process" in the diagnosis function means that you are
logged onto the enqueue server and your work process can access the lock table straight away. You do
not have to delegate enqueue requests to an enqueue process on a remote enqueue server. If you are
logged onto an application server that is not an enqueue server, the diagnosis function will provide you

with the name of the enqueue server.

Each SAP System has exactly one application server that functions as an enqueue server. This enqueue
server maintains the lock table, which is located in a shared memory segment. All of the work processes
on the enqueue server can access the lock table. All work processes on other application servers
delegate their enqueue requests to a special enqueue work process on the enqueue server.
This procedure is configured automatically. The parameter line "rdisp/enqname =<application server
name>" in the default profile DEFAULT.PFL indicates which application server is currently acting as the
enqueue server. When an application server detects that its name matches the name of the enqueue
server, it creates the lock table and all of its work processes process enqueue requests inline. If an
application server detects that its name does not match the name of the enqueue server, it sends all
enqueue requests to the enqueue server.
Work processes of the type "enqueue" guarantee that incoming requests are processed immediately.
One enqueue process is usually sufficient. In very large SAP Systems with many application servers, a
second process can be beneficial. However, it is not expedient to define more than two enqueue
processes. If the transaction SM50 -> [CPU] shows that only the first enqueue process is being used,
the bottleneck is due to something else.
Q.Why is an enqueue work process required in a central system? Don't all work processes
have the same access to the shared memory and thus to the lock table?
A. Although the enqueue process is not used in a central system, it does not do any harm. Since almost
all customers install an application server sooner or later, problems will inevitably arise if the enqueue
process is missing. For this reason, the enqueue diagnosis function will output an error if an enqueue
process has not been configured.
Q. Are the locks in the lock table also set at the database level? If not, database functions
could be used to process objects locked in the SAP system.
A. Locks are not set on the database. The lock table is stored in the main memory of the enqueue
server.
Q. Is a lock table built if an enqueue work process is not started on the enqueue server in the
instance profile?
A. Yes, because the work processes on the enqueue server use the lock table directly, and not via the
enqueue process. The latter is only responsible for lock requests from external application servers.
Q.How can I find out who is currently holding the ungranted lock? In other words, how can
check the program after an ENQUEUE to determine which use is currently holding the lock so
that I can let him or her know?
A. When the ENQUEUE_... function module is returned, the name of the lock owner is listed in SYMSGV1.
Q. Can I use special characters in my lock argument (especially the at sign (@))?
A. The at symbol is used as a wildcard in SAP locks (enqueues). In other words, it can stand for any
other character during collision checks. For example, the parameter value 12345@ locks the quantities
123450 to 123459, 12345a to 12345z, and 12345A to 12345Z, and all other values with any special
character in the 6th character position.
This is described in detail in the section Lock Collisions.
In order to prevent the wildcard mechanism from being activated in SAP locks when it is not required,
you need to ensure when enqueue function modules are called that key value parameters do not contain
any wildcard characters.
If key values that you want to use to lock individual entities do contain wildcard characters, you have to
replace the wildcards with different characters before the enqueue is called.
Q. With a single-process system as an enqueue server, we have reached X SD Benchmark
users. Can this number be increased by using a multiprocessor system (message server on
the same machine as the enqueue server)? Can we assume that scaling is linear (number of
CPUs * X SD users)? How many processes are advisable if message servers, dispatchers, one
dialog, and two enqueue processes are to run on the system?
A. A significant increase in the enqueue server throughput can be expected by using several processors.
The CPU load on the enqueue server is distributed relatively evenly between message server,
dispatchers, and enqueue work processes, which means that up to 3 processors can be occupied
simultaneously. Dispatchers and message server represent the bottleneck with the enqueue. Linear
scaling can be expected for up to 3 processors, even if lock requests are so frequent that message

server, dispatchers, and work processes are occupied simultaneously. Due to asynchronous system
processes (for example, syncer), using more processors can further enhance throughput.

Q. The Syslog often contains messages such as "Enqueue: total wait time during locking:
2500 seconds". How should I analyze this problem? Or is the entry not critical? (There are no
records of terminations or timeouts.)
A. The message is output for information purposes only but may indicate parallel processing errors with
ABAP programs. The specified wait time is the time that has elapsed since startup due to the use of the
WAIT parameter when the enqueue function module was called.
The WAIT parameter enables a lock attempt to be repeated a number of times, for example, so that the
update task does not have to be cancelled when a lock is set temporarily by other programs. The work
process remains busy between the lock attempts.
Q. User cannot connect to SAP
A. Check SAP logon settings, ping the host, check message server, check dispatcher, etc
Q. User cannot print
A. See if the user has proper authoriztion. check SAP user setup, check SPAD, check spools, check unix
queue or print queue at the os level, etc
Q. Why do you get "GetProcessList failed: 80004005" error while starting SAP console
management
A. You have selected one of the Process List nodes in the tree. Then you closed MMC and clicked "Yes" in
the dialog "Save console settings to SAPMMC?". Now when you open again the MMC and those processes
are not started, you get this error.
Solution: Start MMC and select SAP Systems in the tree. Then close it and choose "Yes" in the dialog
"Save console settings to SAPMMC?". Now you won't get this annoying error on every start.

Explain what is SAP security?

SAP security is providing correct access to business users with respect to their authority or
responsibility and giving permission according to their roles.
2) Explain what is roles in SAP security?
Roles is referred to a group of t-codes, which is assigned to execute particular business
task. Each role in SAP requires particular privileges to execute a function in SAP that is
called AUTHORIZATIONS.
3) Explain how you can lock all the users at a time in SAP?
By executing EWZ5 t-code in SAP, all the user can be locked at the same time in SAP.
4) Mention what are the pre-requisites that should be taken before assigning Sap_all to
a user even there is an approval from authorization controllers?
Pre-requisites follows like

Enabling the audit log- using sm 19 tcode

Retrieving the audit log- using sm 20 tcode

5) Explain what is authorization object and authorization object class?

Authorization Object: Authorization objects are groups of authorization field that

regulates particular activity. Authorization relates to a particular action while
Authorization field relates for security administrators to configure specific values in
that particular action.
Authorization object class: Authorization object falls under authorization object
classes, and they are grouped by function area like HR, finance, accounting, etc.

6) Explain how you can delete multiple roles from QA, DEV and Production System?
To delete multiple roles from QA, DEV and Production System, you have to follow below
steps

Place the roles to be deleted in a transport (in dev)

Delete the roles
Push the transport through to QA and production

This will delete all the all roles

7) Explain what things you have to take care before executing Run System Trace?
If you are tracing batch user ID or CPIC, then before executing the Run System Trace, you
have to ensure that the id should have been assigned to SAP_ALL and SAP_NEW. It enables
the user to execute the job without any authorization check failure.
8) Mention what is the difference between USOBT_C and USOBX_C?

USOBT_C: This table consists the authorization proposal data which contains the
authorization data which are relevant for a transaction
USOBX_C: It tells which authorization check are to be executed within a transaction
and which must not

9) Mention what is the maximum number of profiles in a role and maximum number of
object in a role?
Maximum number of profiles in a role is 312, and maximum number of object in a role is
150.
10) What is the t-code used for locking the transaction from execution?
For locking the transaction from execution t-code SM01, is used.
11) Mention what is the main difference between the derived role and a single role?
For the single role, we can add or delete the t-codes while for a derived role you cannot do
that.
12) Explain what is SOD in SAP Security?
SOD means Segregation of Duties; it is implemented in SAP in order to detect and prevent
error or fraud during the business transaction. For example, if a user or employee has the
privilege to access bank account detail and payment run, it might be possible that it can divert
vendor payments to his own account.
13) Mention which t-codes are used to see the summary of the Authorization Object and
Profile details?

SU03: It gives an overview of an authorization object

SU02: It gives an overview of the profile details

14) Explain what is User Buffer?

A user buffer consists of all authorizations of a user. User buffer can be executed by t-code
SU56 and user has its own user buffer. When the user does not have the necessary
authorization or contains too many entries in his user buffer, authorization check fails.
15) By which parameter number of entries are controlled in the user buffer?
In user buffer number of entries are controlled by the profile parameter
Auth/auth_number_in_userbuffer.
16) How many transactions codes can be assigned to a role?

To a role maximum of 14000 transaction codes can be assigned.

17) Mention which table is used to store illegal passwords?
To store illegal passwords, table USR40 is used, it is used to store pattern of words which
cannot be used as a password.
18) Explain what is PFCG_Time_Dependency ?
PFCG_TIME_DEPENDENCY is a report that is used for user master comparison. It also
clears up the expired profiles from user master record. To directly execute this report PFUD
transaction code can also be used.
19) Explain what does USER COMPARE do in SAP security?
In SAP security, USER COMPARE option will compare the user master record so that the
produced authorization profile can be entered into the user master record.
20) Mention different tabs available in PFCG?
Some of the important tab available in PFCG includes

Description: The tab is used to describe the changes made like details related to the
role, addition or removal of t-codes, the authorization object, etc.
Menu: It is used for designing user menus like addition of t-codes
Authorization: Used for maintaining authorization data and authorization profile
User: It is used for adjusting user master records and for assigning users to the role

21) Which t-code can be used to delete old security audit logs?
SM-18 t-code is used to delete the old security audit logs.
22) Explain what reports or programs can be used to regenerate SAP_ALL profile?
To regenerate SAP_ALL profile, report AGR_REGENERATE_SAP_ALL can be used.
23) Using which table transaction code text can be displayed?
Table TSTCT can be used to display transaction code text.
24) Which transaction code is used to display the user buffer?
User buffer can be displayed by using transaction code AL08
25) Mention what SAP table can be helpful in determining the single role that is
assigned to a given composite role?

Table AGR_AGRS will be helpful in determining the single role that is assigned to a given
composite role.
26) What is the parameter in Security Audit Log (SM19) that decides the number of
filters?
Parameter rsau/no_of_filters are used to decide the number of filters.