Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Mass lock/unlock of user ID's

Former Member
0 Kudos

Hi

We have to lock 50 000 + users when maintenance needs to be done on the system.

Currently using su10 or EWZ5 takes more than an hour to lock and or unlock the users.

Is there a quicker way to get the users locked. Is anyone doing this programmatically ?

What are the pitfalls when writing an ABAP just to change the user flag on USR02?

Thnx

BRian

11 REPLIES 11

Former Member
0 Kudos

I would just go for the ABAP (or direct update in the database via sql script). Works like a charm!

Kind regards,

Mark

0 Kudos

... problem then: no change logs exist then. Of course this is pretty fast. But if you need to monitor your system (audit) this solution is not acceptable....

b.rgds, Bernhard

0 Kudos

> or direct update in the database via sql script

No, please don't. There is an application on this database, use it. Operating the proper switches is always safer than short-circuiting the wires.

Have a look at BAPI_USER_LOCK & BAPI_USER_UNLOCK and program something around that.

Using BAPI's or FM's will make sure everthing keeps working in case SAP decides to change the data structure. and they have done quite some changing in the past.....

Edit: The BAPI's take care of change logs as well.

Edited by: Jurjen Heeck on May 10, 2010 2:08 PM

0 Kudos

> The BAPI's take care of change logs as well.

....and normally that is the cause for long runtimes...

Former Member
0 Kudos

I think you can use parellel processing. I.e. For example use 5 sessions each with 10,000 users. Have you tried this approch?

Former Member
0 Kudos

You can try another shortcut if it suits your need.

You can simply lock the client itself so that no user can login. But the only drawback is that any maintenance that you need to carry out would then be possible in a different client than the one that you lock.

How do you do this? Simple, just run the following command at OS level:

tp locksys <SID> client<client_number> pf=<path to transport profile>

in order to unlock the client later, just give the opposite command:

tp unlocksys <SID> client<client_number> pf=<path to transport profile>

Well, if you still need to lock the users only, then keep in mind one thing that before starting to mass lock the users, export a list of all users that are already locked in the system due to licensing and other similar issues. This is so that when you come to unlocking the users, these previously locked users are not unlocked by mistake. Got my point?

Regards

Shitij

Former Member
0 Kudos

Going for a ABAP code would be efficient way for handling locking of mass user . It hardly takes minutes to lock the users.

Thanks.

Anjan

0 Kudos

Rather than locking huge number of users, I dealt it using user logon user exit - enhancement SUSR0001. the logical should be like that

1. Create a table for all of your applications server with a indicator for maintainance.

2. create a table for all of your basis administrators

2. when user logon, if the user exit find that maintainance indicator has been swtiched on, then it checks if the user is in the basis administrator list, if not, kick off the user immediately.

Simple AND charm, isn't it?

Former Member
0 Kudos

What you can do as well, if users are logging on via a logon group, just disable this logon group.

Kind regards,

Mark

0 Kudos

>

> What you can do as well, if users are logging on via a logon group, just disable this logon group.

>

> Kind regards,

>

> Mark

trust me you wont be able to stop smart user, power user, developers etc.

0 Kudos

True, but you block probably 98%. The rest can be done manually..