Change program on prd system

[Former Member]

I want do NOT allow a sap user to change / create ABAP programs on PRD system, without taking his sscr key. How do I do?

[Former Member]

Check out the check/maintain objects associated with SE38 in SU24. ( e.g - S_PROGRAM) . By restricting all these objects you can put the necessary restriction as required.

[jurjen_heeck]

Client settings in SCC4 (should) protect this. Besides that, take a good look at objects S_ADMI_FCD and S_DEVELOP.

[Former Member]

Thanks for your help.

I looked in scc4 and found the following configuration:

Change and transports for client-specific objects:

"automatic recording of changes"

Cross-client changes:

"No changes to cross-client Customizing objects"

Protection: client copier and comparation tool:

"protection level 0"

catt and ecatt restrictions:

"ecatt and catt not allowed"

I want to do the following configuration:

Change and transports for client-specific objects:

no changes allowed

Cross-client changes:

no changes to repositoru and cross-lient customizing obj

Protection: client copier and comparation tool:

protection level1 : No overwriting

catt and ecatt restrictions:

eCATT and CATT not allowed

Do you think that would solve the problem that if I do this configuration ?

You think other problems occur if this configuration would make?

Thanks for help

[jurjen_heeck]

> Do you think that would solve the problem that if I do this configuration ?

It should.

> You think other problems occur if this configuration would make?

It shouldn't.

Check this [SAPHelp page on client settings|http://help.sap.com/saphelp_nw70/helpdata/en/57/38de9b4eb711d182bf0000e829fbfe/frameset.htm].

Edit: This is the page: http://help.sap.com/saphelp_nw70/helpdata/en/57/38dea84eb711d182bf0000e829fbfe/frameset.htm

Edited by: Jurjen Heeck on Oct 8, 2009 1:38 PM

[Former Member]

Ok sir.

I will configure the system and only if i have other problems will return. Until then I think the subject is closed.

Thank you very much for your help.

Good day.

[Former Member]

Just a side note: If you only restrict the client settings for development and not the developer authorizations, then a semi-skilled developer will anyway create programs and do what ever they want, if they are inclined this way.

In honesty, if they have this inclination then they will probably have their own development environments installed already in which case they will not need much (or any...) authorizations either.

In some cases I have seen, you don't even need a user ID in the system to program in it if your config is suboptimal and you do not do code reviews.

Cheers,

Julius