SAP Library - Find your answers

1. How to lock the client from logon
2. How to see the all the users connected per day (with the activities they have done and resource utilization)

I cannot answer the first straight away, but the second questions, there are many available SAP transactions.

use STAT very useful and many options available if you use them correctly.

1. I don't know how how to lock the client, but you can lock the system with "tp locksys " and unlock it with "tp unlocksys ". You can also stop the service, but then noone can login including yourself. However, I had problems with tp locksys when applying some Hot Packages and exporting client. It wouldn't work with system locked. I didn't try, but a simple ABAP that locks and unlocks all the users in table usr02 (with exceptions of yourself, SAP*, DDIC... - ofcourse) might be an interesting idea.

2. STAT transaction

You can lock the system thro "tp locksys" (Transport Utility).
Check the other options of "tp" command for locking the specific client under the system thro "tp help".

With this solution I can lock the whole system, but not specified by client.
Send me in more detail....

There's no way to lock a client.
You have to lock all users from loging in of this specified client.
The way you do is by user administration setting the lock.

We can lock a client using SCCR_LOCK_CLIENT and unlock SCCR_UNLOCK_CLIENT functions.

Once we run this functions with a client as input , that client will be locked/unlocked. Actually this function set flag '' Client is locked temporarly for client copy" in client maintanance menu. And the client will be available for users other than DDIC and SAP*. If you try to login in that client as any user , system gives message that ' Client locked temporarly'..

Is there any t-code to lock a client?

There is no direct tcode to lock a client. the easiest way to lock a client is
1. run tcode SE37
2. type function module name - SCCR_LOCK_CLIENT
3. enter the Client No.
4. execute the function module.

If you've dealt with EWZ5 in the past, you know that it can be somewhat confusing.
To make things easier you can use SU10 to lock and unlock select groups of users or all
users.

Goto SE37
Run the report "SCCR_LOCK_CLIENT" and Press F8
Enter the Client No. and Press F8
The selected client would be locked.

To Unlock the Client
Goto SE37
Run the report "SCCR_UNLOCK_CLIEN" and Press F8
Enter the Client No. and Press F8
The selected client would be unlocked.

Keyword: BASIS
Title : SAP Lock Types

BEFORE CLEARING A LOCK FOLLOW THE BELOW STEPS:-

To clear a lock, complete these steps on the system’s application and the database servers:
1. Check that the user is not logged on any of the servers with transaction SM04 (no application servers) or AL08 (with application servers).
If the user is not on the system, but transaction SM04 shows them on the system, delete their sessions. This step, by itself, may clear the lock.
2. Check that there are no processes running under the user ID using transaction SM50 or SM51.
3. Check that there are no batch jobs running under the user ID using transaction SM37.
4. Check that there are no updates in process for that user ID using transaction SM13.
5. Once you know that there is no activity using the user’s ID, select the lock entry for deletion.
6. Choose Lock entriesDelete.

To lock or unlock a client in R/3 System, run the following function modules in transaction se37

1. SSCR_LOCK_CLIENT ( to lock the client)
2. SSCR_UNLOCK_CLIENT (to unlock the client)

Run these functions with a client input which is to be locked/unlocked. This function set flag '' Client is locked temporarily for client copy" in client maintenance menu.The client will be available for users DDIC and SAP*. If any other user tries to login, system gives message that ' Client locked temporarily'.


To unlock the client

1. Run transaction SE37
2. Enter the function module as SSCR_UNLOCK_CLIENT
3. press F8 or test run (single run).
4. Specify the client and execute(F8).

Follow similar procedure for locking the client

To lock or unlock a client in R/3 System, run the following function modules in transaction se37

1. SSCR_LOCK_CLIENT ( to lock the client)
2. SSCR_UNLOCK_CLIENT (to unlock the client)

Run these functions with a client input which is to be locked/unlocked. This function set flag '' Client is locked temporarily for client copy" in client maintenance menu.The client will be available for users DDIC and SAP*. If any other user tries to login, system gives message that ' Client locked temporarily'.


To unlock the client

1. Run transaction SE37
2. Enter the function module as SSCR_UNLOCK_CLIENT
3. press F8 or test run (single run).
4. Specify the client and execute(F8).

Login to the system database..then run a query to update the USR02 table.

To lock an user.

SQL> UPDATE USR02 SET UFLAG = '64' where BNAME='USERID' AND MANDT='CLIENT'
SQL> COMMIT

To unlock an user use

SQL> UPDATE USR02 SET UFLAG = '0' where BNAME='USERID' AND MANDT='CLIENT'
SQL> COMMIT

Here the different values of uflag have different meaning
UFLAG value

0 ------ Not locked

16 ------ Mystery values

32 ------ Locked by CUA admin

64 ------ Locked by system Administrator

128 ------ Locked due to incorrect logon attempts or too many failed attempts

192 ------ A combination of both. The user is locked by admin and user tries to logon with incorrect passwords and gets locked ( 192 = 64+128)

A “SAP lock” is named “enqueue lock”, the enqueue is on a much higher level, e. g. a complete sales document is locked there whereas in the datbase usually only row locks exist.

Mass Lock All Printers with SPAD

If you have lots of printers (50 or more) and need to lock them for maintenance, you can used this mass locked printers tips to locked or unlocked all the SAP printers at one go.

To mass Lock all the printer in SAP:

Go to transaction code SPAD

On top of the screen menu click Utilities -> For output devices -> Export devices

On the screen Import and Export of Device Descriptions:

Export/Import file name: c:\temp\printer.txt

Frontend computer: Tick

Export: Tick

Export Export: Tick

Output device: Choose the Selection options Pattern and type a *
(* for all or a* for all printers starting with a)

Click the Execute button

Open the text file do a replace all of PADISABLED = "" to PADISABLED = "X"

Then import the same file.

or

Another way is to go through each output device in SPAD and click on 'Lock Printer in SAP System' which is in the DeviceAttributes tab

If you have lots of printers (50 or more) and need to lock them for maintenance, you can used this mass locked printers tips to locked or unlocked all the SAP printers at one go.

To mass Lock all the printer in SAP:

Go to transaction code SPAD

On top of the screen menu click Utilities -> For output devices -> Export devices

On the screen Import and Export of Device Descriptions:

Export/Import file name: c:\temp\printer.txt

Frontend computer: Tick

Export: Tick

Export Export: Tick

Output device: Choose the Selection options Pattern and type a *
(* for all or a* for all printers starting with a)

Click the Execute button

Open the text file do a replace all of PADISABLED = "" to PADISABLED = "X"

Then import the same file.

or

Another way is to go through each output device in SPAD and click on 'Lock Printer in SAP System' which is in the DeviceAttributes tab

Lock Transaction SM12:

The SAP system is equipped with a special lock mechanism the purpose of the lock mechanism is to prevent two transactions from changing the same data on the database simultaneously.
Locks are defined generically as "lock objects" in the Data Dictionary. Lock entries are usually set and deleted automatically when user programs access a data object and release it again.

The SAP lock mechanism is closely related to the Update Mechanism .

The documentation is divided into the following sections:

SAP Lock Concept: describes how the SAP lock works. You have to understand the concepts described here in order to use the SAP locks when you are programming applications. You can use different types of locks. The lock mode describes what type of lock it is.

S (shared Lock): Several users can access locked data at the same time in display mode. Requests from further shared locks are accepted, even if they are from different users. An exclusive lock set on an object that already has a shared lock will be rejected.

E(Exclusive): An exclusive lock protects the locked object against all types of locks from other transactions. Only the same lock owner can reset the lock .

Important Profile Parameters: A list of the profile parameters relevant for the lock concept.
enque/table_size: Size of the lock table managed by the enqueue server in the main memory. The lock table contains information on which locks are currently held by whom.

In this case, you should check whether the update server is functioning correctly, since the lock table can grow very fast if the update function stops. If no update problems exist, you can use this parameter to increase the size of the lock table.
The Computing Center Management System (CCMS) monitors the status of the lock table constantly and outputs warnings if the space available is not adequate.
Default value: 4096kb

rdisp/wp_no_enq: Number of enqueue work processes that are to run on this instance.
rdisp/enqname: Name of the application server that provides the enqueue service.

Managing Lock Entries: It describes lock management , which you use to display, check, and delete lock entries. This may be necessary if the SAP dispatcher, the operating system, or the network connection fails, and the dispatcher cannot delete lock entries. In this case, invalid lock entries remain effective and block access to the locked data when the system is restarted.

How to monitor a Lock entry:In SM12 check any lock entry older than 2 days, if any outdated entry check the corresponding User and check the user online or offline in AL08 and contact that User (you can get the User info from su01) and inform about the lock else if the user is offline release the table from lock by deleting the lock.

If you want the user to be locked after unsuccessful logon attempts, you can put a parameter in the Instance Profile to prevent them from doing so.

Transaction RZ10--> Instance Profile--> Extended Maintenance

Use the 'login/fails_to_user_lock' Parameter.
Defines the number of unsuccessful logon attempts before the system locks the user. By default, the lock applies until midnight.

Default value: 12; permissible values: 1 -99

To remove the lock after midnight :
login/failed_user_auto_unlock: Defines whether user locks due to unsuccessful logon attempts should be automatically removed at midnight.

Default value: 1 (Lock applies only on same day); permissible values: 0, 1