Enclosure 5.1.

2: Assignment of System Authorisations in SAP R/3

At the moment this list is under discussion because HI/Basis support intends to restrict some
of the authorisations, especially with respect to user administration and authorisation
administration. The current status will be published in the IT Security section of the Henkel
Intranet.

checkpoint Authorisation * only for:

* to be adjusted for the appropriate SAP version
user administration
create users S_TCODE with TCODE 'SU01' - central user administration,
S_USER_GRP with activity '01' - system administrators

delete users S_TCODE with TCODE 'SU01' - central user administration,

S_USER_GRP with activity '06' - system administrators

change users (assign profiles) S_TCODE with TCODE 'SU01' - central user administration,
S_USER_GRP with activity '02' - local user administrators
S_USER_PRO with activity '22' (restricted to user groups)
- system administrators

change passwords S_TCODE with TCODE 'SU01' - central user administration,

S_USER_GRP with activity '02'
- local user administrators
(restricted to user groups)
- Help Desk
- application responsibles
- system administrators

revoke users S_TCODE with TCODE 'SU01' - central user administration,

S_USER_GRP with activity '05'
- local user administrators
(restricted to user groups)
- Help Desk
- application responsibles
- system administrators

authorisation administration
create profiles
create activity groups
create/delete authorisations
change profiles
change activity groups
change authorisations
S_TCODE with TCODE 'SU02' - authorisation administrators
S_USER_PRO with activity '01' and '07'
S_TCODE with TCODE 'PFCG' - authorisation administrators
S_USER_AGR with activity '01'
S_USER_PRO with activity '01' and '07'
S_TCODE with TCODE 'SU03' - authorisation administrators
S_USER_AUT with activity '01' or '06'
S_TCODE with TCODE 'SU02' - authorisation administrators
S_USER_PRO with activity '02' and '07'
S_TCODE with TCODE 'PFCG' - authorisation administrators
S_USER_AGR with activity '02'
S_USER_PRO with activity '02' and '07'
S_TCODE with TCODE 'SU03' - authorisation administrators
S_USER_AUT with activity '02'

1
Change Management
execute imports
change changeability of clients
change system changeability
authorisation for development
Debugging with Replace
update basic tables via standard S_TCODE with TCODE 'SM30' or 'SM31'
transactions
Basic Functions
update profile parameters
stop application servers
stop working processes
revoke transactions
reading spool orders from other
users
reading spool orders from other
users out of TemSe
planning background jobs with
other user ID
TA Tool: ZS03 - system administrators
TMS: - emergency user
S_TCODE with TCODE 'STMS'
S_CTS_ADMI
S_TCODE with TCODE ‘SCC4‘ - system administrators
S_TABU_DIS with activity ‘02‘ and Table - emergency user
class 'SS'
S_TABU_CLI with 'X'
S_TCODE with TCODE ‘SE06‘ or 'SE03' - system administrators
S_CTS_ADMI with function ‘INIT‘ and ‘SYSC‘ - emergency user
S_TRANSPRT with activity '03' and
TTYPE='*'
S_TCODE with ‘SE38‘ - system administrators
S_DEVELOP with activity '01' or '02' and - emergency user
object type 'PROG'
S_DEVELOP with activity ‘02‘ and object type - emergency user
‘DEBUG‘
- system administrators
S_TABU_DIS with activity '02' and table class - emergency user
'SS'
S_TCODE with TCODE ‘RZ10‘ - system administrators
S_RZL_ADM with activity '01'
S_TCODE with TCODE ‘RZ03‘ - system administrators
S_RZL_ADM with activity '01'
S_TCODE with TCODE 'SM04' or 'SM50' - system administrators
S_ADMI_FCD with function 'PADM' - emergency user
S_TCODE with TCODE ‘SM01‘ - system administrators
S_ADMI_FCD with function 'TLCK' - emergency user
S_TCODE with TCODE = 'SP01' - system administrators
S_SPO_ACT with spool action 'DISP' - application responsibles
S_ADMI_FCD with function 'SP01' or 'SP0R' - emergency user
S_TCODE with TCODE 'SP11‘ or ‘SP12‘ - system administrators
S_TMS_ACT with STMSACT=‘REA‘, - application responsibles and
STMSOWNER=‘GRP‘ or ‘OCL‘, end users, restricted to special
STMSOBJECT=‘SPOOL*‘ groups (if possible)
S_BTCH_NAM or S_BTCH_ADM with - system administrators
marking 'Y' - application responsibles
- emergency user
2
delete change documents
delete revoke entries
delete vouchers
delete clients
Interfaces
update RFC connections
update ALE distribution model
edit IDOCs
execute batch input
(background execution)
create logical system commands S_TCODE with TCODE ‘SM69‘
S_RZL_ADM with activity ‘01‘ or '02'
S_LOG_COM
execute logical system
commands
S_TCODE with TCODE 'SE38' or 'SA38' and - nobody
S_SCD0 with activity '06' or '12'
S_TCODE with TCODE ‘SM12‘
S_ENQUE with activity 'DLFU' or 'ALL'
S_TCODE with TCODE 'SM13'
S_ADMI_FCD with function 'UADM'
S_TCODE with TCODE ‘SCC5‘
S_TABU_CLI = ‘X‘
S_TCODE with TCODE 'SM59'
S_ADMI_FCD with function 'NADM'
S_TCODE with TCODE ‘SALE‘
B_ALE_MODL with activity '01 or '02'
S_TCODE with TCODE ‘WE02‘
S_IDOCMONI with activity '02'
S_TCODE with TCODE ‘SM35‘
S_BDC_MONI=‘ABTC‘
S_TCODE with TCODE ‘SM49‘
S_LOG_COM
- system administrators
- application responsibles
- emergency user
- system administrators
- application responsibles
- emergency user
- system administrators
- system administrators
- ALE/EDI responsibles
- emergency user
- system administrators
- ALE/EDI responsibles
- emergency user
- system administrators
- ALE/EDI responsibles
- emergency user
- system administrators
- application responsibles
- emergency user
- system administrators
- system administrators
- application responsibles
- emergency user
3
Definition of Roles in the
granting process:
system administrators responsibles for the SAP system(s)
(partly with special Admin-ID)

application responsibles responsibles for a module or process

central user administration responsibles for creating user IDs and assigning user authorisations

decentral user administration responsibles for assigning user authorisations within their department

help desk responsible for resetting passwords and revoking user IDs

ALE/EDI responsibles IT members with special tasks

Authorisation administrators Responsible for the SAP authorisation profiles