SAP Library - Find your answers

When an administrator creates a user account he assigns an initial password that has to be changed immediately when used for the first time.

When an administrator creates a user account (of type DIALOG or COMMUNICATION, see note 622464) he assigns an initial password that has to be changed immediately when used for the first time.
Note: The lifetime of initial passwords can be restricted (see notes 379081 and 450452).

Passwords reset by the administrator also need to be changed by the user on the next subsequent (interactive) logon.
Note: The lifetime of reset passwords can be restricted (see notes 379081 and 450452).

The default minimum length for passwords is 3. You can change this value with the profile parameter login/min_password_lng.
The maximum length is 8.
Passwords cannot have the symbols ""?"" or ""!"" as the first character.
The first 3 characters cannot occur in the same order in the user ID.
Note: As of Release 6. 10 (Web Application Server) this rule has been removed. It will only be checked in all releases up to 4.6D.

The first 3 characters cannot be identical.
The first three characters cannot contain space characters.
Note: As of Release 6. 10 (Web Application Server) this rule has been removed. It will only be checked in all releases up to 4.6D.

The password cannot be ""PASS"" or ""SAP*"".
The administrator can define patterns of ""illegal passwords"" (USR40).
You can use all characters from the syntactical character set, that is, all letters, figures, and some special characters.
Note: As of Release 6. 10 (Web Application Server) the password rules have been enhanced. It is then possible to define the minimal numbers of digits / characters / special characters that have to occur in new passwords:

login/min_password_digits

login/min_password_letters

login/min_password_specials

The system does not distinguish between upper and lower case.
The password can only be changed by the user after entering the correct old one.
Note: Prior to Release 6. 20 (Web Application Server) the password can only be changed during the course of logging on. As of Release 6.20 the password can be changed using the menu path ""System > User Profile > Own Data"" (SU3).

The new password must differ from the old password by at least one character (i.e. they cannot be identical).
Note: As of Release 6. 10 (Web Application Server) the minimum number of characters which differ between old and new password can be customized (login/min_password_diff).

The last 5 passwords that have been chosen by the user are stored in a user-specific password history and cannot be reused.
Note: The size of the password history is static (5) and cannot be customized.

The password can be changed by the user at most once a day. This rule prevents users from bypassing the password history rule.
Note: The administrator can reset user passwords at any time.

Changed password rules do not affect old passwords; password rules will only be evaluated at the moment the password change takes place.

As of Release 6.10 function module PASSWORD_FORMAL_CHECK can be used to determine whether a given string is compliant to the current password rules.

The following are rules for memory management under Windows NT:

Minimizing the Windows NT File Cache

Maximum Use of Extended Memory

Setting Dimensions for Sufficient Extended Memory

Determining the Number of Work Processes, compared to reducing UNIX

Parameter Overview for Windows NT

Overview of the improvements and changes in password rules or logon procedures that are delivered with Web AS ABAP 7.00 or NetWeaver 2004s

Passwords: Differentiation between upper and lower case; maximum length increased from eight to forty characters
For new passwords, the system distinguishes between upper and lower case ; in addition, passwords can now consist of up to forty characters (up until now, the maximum has been eight characters). In newly-installed systems, this applies immediately to all users; in systems that have been upgraded to Web AS ABAP 7.00 or NetWeaver 2004s from an earlier release, we have ensured that all users can continue to log on using their old password. Information that tells the system whether a user has a new password or a password of the old type is stored in the user master record; this information is analyzed when the system checks the password: if the user has a password of the old type, the system converts the first eight characters of the password into upper case; the remaining thirty-two characters must be spaces. Otherwise, the password is analyzed in its entirety and without being converted into upper case. In Unicode systems, you can use Unicode characters in passwords.

Relevant (new) profile parameters:
login/min_password_lowercase
login/min_password_uppercase
login/password_downwards_compatibility
Password history: size can now be defined as required (it used to be limited to five entries)
The passwords that the user has assigned in the course of a password change are stored in the password history (passwords set by the user administrator are not stored in the password history). The system prevents the user from reusing previously-used passwords. The password history used to be limited to five entries; you can now define the size of the password history (maximum value: 100 entries) using a profile parameter (login/password_history_size).
Lock period for password change can be selected (it used to be limited to one day)
To prevent the password history from being bypassed, a user may only change his or her password again after the lock period has passed (exception: the user is asked to change the password by the system). You can now select this lock period using the profile parameter login/password_change_waittime (maximum value: 1000 days).
(Advance) password change with stricter password rules
You can now set the system so that it asks only users whose current password no longer satisfies the current (stricter) password rules to change their password (in advance). To do this, set the profile parameter login/password_compliance_to_current_policy = 1.
Validity period of unused passwords can be restricted
Passwords that are not used by the authorized user are a security risk. For this reason, you are now able to restrict the validity period of these passwords; here, the system distinguishes between initial passwords (that is, passwords that are assigned by the user administrator and that are to be changed by the user at the next opportunity) and non-initial passwords (that is, passwords that have been set by the user). (Technical) users of the type SERVICE and SYSTEM are exempt from this regulation.

Relevant (new) profile parameters:
login/password_max_idle_initial
login/password_max_idle_productive
Logon: Compromising error messages are avoided
If you attempt to log on using incorrect logon data, the system now only issues the generic error message "Name or password is incorrect" as a rule; further reasons for failed logons (for example, locked user accounts, user account is outside validity period, and so on) are only given in detail when valid logon data has been passed. Error scenarios in which the system could not check the logon data, or where no further check is allowed are the exceptions to this rule:
"User has no password - logon using password is not possible"
"Password logon no longer possible - too many failed attempts"
The default values of certain profile parameters that are relevant to security have been changed:
login/failed_user_auto_unlock : 0 (instead of 1)
Locks for failed logon attempts remain valid for an unlimited period.
login/fails_to_user_lock : 5 (instead of 12)
The lock for failed logon attempts is set after five failed passwordlogon attempts.
login/no_automatic_user_sapstar : 1 (instead of 0)
The emergency user must be activated explicitly.
login/min_password_lng : 6 (instead of 3)
Passwords must consist of at least six characters.
login/ticket_expiration_time : 8 (instead of 60)
Logon tickets are only valid for eight hours.
The profile parameters login/password_max_new_valid and login/password_max_reset_valid have been replaced by the profile parameter login/password_max_idle_initial, which means that the system no longer distinguishes between the first and the subsequent setting of a password by the user administrator regarding the restriction of the validity of the resulting initial passwords.

Keyword: SAP HR
Title : Schemas and Personnel calculation rules