2

I am trying to find out a report/program that can help me in getting the list of t-code changes for users for a particular duration.

For e.g. :

  • t-code SU01 was assigned to user ABC on 13th March 2016.
  • t-code ME21n was removed from user XYZ on 14th March 2016

Does SAP have a standard report for this?

Sandra Rossi
  • 11,934
  • 5
  • 22
  • 48
user2339071
  • 4,254
  • 1
  • 27
  • 46

1 Answers1

1

There is no single place for tracking certain tcode assignments just because it is not possible in SAP ECC to assign transaction per se. They are to be assigned via roles and profiles, more about AS ABAP authorization concept is here.
Therefore, in order to achieve the goal described in the question the steps should be following:

  1. Find out which roles contain the tcode(s) you are going to track

This can be done in SUIM transaction. Go to Roles >> By authorization values, enter in Authorization object value S_TCODE, press Input values button and enter tcodes you want to track.
Save role names to file (via Export menu or using ALV tools). 2. Generate change document list according to above tcodes. This can be done via S_BCE_68002311 transaction. In this transaction go to Roles/Profiles tab in the bottom and enable Roles checkbox, having loaded all those saved roles from file into multiple selection box (select options).

After execution of the report you should see something like this

enter image description here

UPDATE concerning your questions

  1. Cant it be done for all the t-codes?
    No. You can run this report without specifying any role which will affect all tcodes, but!
    You won't be able to distinguish who is who - role names won't tell you anything meaningful.
  2. Also, what if the t-code authorization is present in more than one role?
    All roles with this tcode will be listed.
  3. And a role contains various t-codes?
    This role will be listed only once no matter how many tcodes it contains.

UPDATE 2: for checking which authorizations were added to role (which tcodes)

  1. Go to tcode RSSCD100_PFCG
  2. Mark Authorization datf in the Change documents box
  3. Execute the search and you will see the auth values which were added to the role and when

enter image description here

How to map the authorization object with tcode is explained at the beginning of my answer.

Suncatcher
  • 10,355
  • 10
  • 52
  • 90
  • Cant it be done for all the t-codes? Also, what if the t-code authorization is present in more than one role? And a role contains various t-codes? – user2339071 Jan 29 '17 at 15:20
  • One problem I foresee is lets assume, I get the list of role changes from SUIM, and I get the mapping of tcodes to role, how will I know which t-code was added/removed as a part of the role change? All I will be able to see is the role being added/removed. Not the tcode. – user2339071 Jan 29 '17 at 16:18
  • @user2339071 added explanation in UPDATE 2 – Suncatcher Dec 04 '20 at 09:58