objects deleted by adding a transaction !

[Former Member]

Hello Experts ,

Today i came with a really awkward problem : By adding a transaction in a role before two days , today someone reported an error ..and there was a missing object that existed in the role . I checked the change documents of the role and i saw that 3 objects have been deleted (??) the same time i added the custom transaction .

I did a research and i had another case where i removed a Tx and there where several other objects that were removed as well . Not only the objects assigned to the Tx but also other ones.

Would appreciate any help

Cheers ,

David

[Former Member]

> Would appreciate any help

The transaction you added was PFCG, and then the user with the same role set the objects to inactive?

Did you to a "Read old Merge with new" as well? It might be that the check indicators have changed, and a standard authorization is no longer proposed.

Cheers,

Julius

[Former Member]

No , it was a customizing transaktion..And yes i did try once with read old status and merge with new data , the result was the same

Still working on the problem ..but as usual there are many other jobs coming in the way with higher prio 😛

Cheers,

David

[Former Member]

> No , it was a customizing transaktion.

If you mean "customizing" as in an IMG type of transaction, then which one was it?

Also, which release are you on now?

Cheers,

Julius

[Former Member]

Hi Julius ,

The transaktion i added was a FI customized transaction for releasing blocked invoices. But i dont think this problem is connected to the transaction.

Also when i deleted the transaction OASV (enter transfer posting) from a large Display role (11500 Tx) i saw that objects that are not connected to this transaction where deleted as well . I checked over SU24 which objects are connected to the OASV and the object B_MASSMAIN for example,that was deleted, was not there.

We have SAP R/3 4.7 ,

Thanks !

David

[jurjen_heeck]

> Also when i deleted the transaction OASV (enter transfer posting) from a large Display role (11500 Tx) i saw that objects that are not connected to this transaction where deleted as well . I checked over SU24 which objects are connected to the OASV and the object B_MASSMAIN for example,that was deleted, was not there.

Ah, I see you're thinking the wrong way around and that mistake is easily made....

Unfortunately PFCG does not calculate a delta when you remove a transaction but will re-evaluate the customer tables' data for the transactions left in the role....... So if the proposals for any of these have changed in the mean time you'll see unexpected changes.

[Former Member]

Hi Jurjen ,

So let me understand : if the proposals for any of these have changed : you mean that if changes are being made in SU24 for the the other transactions it will affect the roles objects ? because there werent any changes in the other transactions i think .

Is there a way to eliminate this common mistake ? normally when i open the authorization data with read old status and merge with new data i shouldnt lose any objects.

Appreciate your help but still this is not clear to me

[jurjen_heeck]

> still this is not clear to me

It puzzles me as well sometimes. What also could have happened in your case is that the role menu has been altered in the past without changeing the actual authorization data.....

SU24 and the propsals in PFCG are really nice when building roles but they can be a pain in maintenance....

[Former Member]

> It puzzles me as well sometimes. What also could have happened in your case is that the role menu has been altered in the past without changeing the actual authorization data.....

Yes, I was thinking of something similar as well. Someone might have had to "Remove a transaction" but did not dare to regenerate the profiles for some reason.

Another possibility is that someone else is also working on the role at around the same time.

Either way, run the change documents for the role to see who else has made changes?

Cheers,

Julius

[Former Member]

This message was moderated.

[Former Member]

Did you checked the number of Authorizations in this role. There is a limit to the number of authorizations in a single role..possibly as it seems from one your thread the number of t-codes in this role is well over 1500 ...so its possible that the role has crossed the authorizations limit and hence deleting something which it should not in normal scenario.

try to create a temp role with that t-code on adding which other authorization object was deleted and also the t-code that get affected when this authorization object was deleted and see the result now.