Oracle SAPSR3 user locked

[Former Member]

Hi

I am new to SAP.

I have installed SAP ERP 6.0 on Win 64 bit with Oracle 10.2

Installation was successful. All the processes in SAP management cosole were up.

I checked the following urls

http:
<IP>:50000\nwa

http:
<IP>:50000\irj

http:
<IP>:50000\rep

http:
<IP>:50000\sld

I was able to login in nwa with J2EE_ADMIN

For some reasons I had to restart my server, after that I found that disp_work dint start and SAPSR3 was locked. I am unable to recall any significant change that can cause this issue.

As guided on different forums and on SAP note 400241 & 50088, I checked the following

dev_w<xx> logs were showing message

C Oracle Client Version: '10.2.0.2.0'

C Client NLS settings: AMERICAN_AMERICA.UTF8

C Logon as OPS$-user to get SAPSR3's password

C Connecting as /@NG1 on connection 0 (nls_hdl 0) ... (dbsl 700 250407)

C Nls CharacterSet NationalCharSet C EnvHp ErrHp ErrHpBatch

C 0 UTF8 1 00000000117E8120 00000000117F0350 000000001180CB78

C Attaching to DB Server NG1 (con_hdl=0,svchp=000000001180CA38,srvhp=000000001180EE68)

C Starting user session (con_hdl=0,svchp=000000001180CA38,srvhp=000000001180EE68,usrhp=00000000117F0B68)

C *** ERROR => OCI-call 'OCISessionBegin' failed with rc=1017

[dboci.c 4532]

C *** ERROR => CONNECT failed with sql error '1017'

[dbsloci.c 11044]

C Try to connect with default password

C Connecting as SAPSR3/<pwd>@NG1 on connection 0 (nls_hdl 0) ... (dbsl 700 250407)

C Nls CharacterSet NationalCharSet C EnvHp ErrHp ErrHpBatch

C 0 UTF8 1 00000000117E8120 00000000117F0350 000000001180CB78

C Starting user session (con_hdl=0,svchp=000000001180CA38,srvhp=000000001180EE68,usrhp=00000000117F0B68)

C *** ERROR => OCI-call 'OCISessionBegin' failed with rc=28000

[dboci.c 4532]

C Detaching from DB Server (con_hdl=0,svchp=000000001180CA38,srvhp=000000001180EE68)

C *** ERROR => CONNECT failed with sql error '28000'

[dbsloci.c 11044]

B ***LOG BY2=> sql error 28000 performing CON [dbsh#2 @ 1204] [dbsh 1204 ]

B ***LOG BY0=> ORA-28000: the account is locked [dbsh#2 @ 1204] [dbsh 1204 ]

B ***LOG BY2=> sql error 28000 performing CON [dblink#5 @ 431] [dblink 0431 ]

B ***LOG BY0=> ORA-28000: the account is locked [dblink#5 @ 431] [dblink 0431 ]

M ***LOG R19=> ThInit, db_connect ( DB-Connect 000256) [thxxhead.c 1440]

I checked the users in oracle database service

I found following users [NG1 is SID and SAP-SERVER is macine name]

OPS$SAP-SERVER\NG1ADM

OPS$SAP-SERVER\SAPSERVICENG1

OPS$SAP-SERVER\SAPSERVICESR3

I tried to connect to sqlplus with all above users, it was fine. Even tried to connect without machine name that also worked fine.

I checked sqlnet.ora, settings were fine

SQLNET.AUTHENTICATION_SERVICES = (NTS)

I checked Oracle parameter remote_os_authent, its value is true

os_authent_prefix is OPS$

password for SAPSR3 user in oracle was not SAP

Everything looked OK, finally I changed the password for SAPSR3 to SAP and executed the command

brconnect -u NG1ADM/SAP12345 -f chpass -o SAPSR3 -p SAP

and started my SAP server instance, it started successfully.

Can anybody help on this, how can I keep a different password for SAPSR3.

Do I need to create users like :-

OPS\NG1ADM

OPS\SAPSERVICENG1

OPS\SAPSERVICESR3

Thanks

Ruhi

[Former Member]

Hi,

The disp_work start problem is look like the Oracle TNS Listner error, please start the listner, check the status of the listener from OS level and Start the SAP from the MMC console.

Thanks

Ahamed

[Former Member]

Reinstalled.

Now its working fine.

Couldn't find the root cause.

Ruhi

[Former Member]

Hi Ruhi,

Here 2 errors are showing in your scenario. 1) user id was locked means not in active status

2) Wrong database user or wrong details contained in SAPUSER table.

For 1st one means ora:28000 just active the user with below command

alter user SAPSR3 status acrive;

for 2nd erro you need to see the exact database schema owner and create SAPUSER table appropriate:

And make sure that your env variables have the correct entries.

Regards

Nick Loy

[Former Member]

Hi,

You can reset the password on os level.

Anil

[Former Member]

Hi Ribi,

It seems like you are using windows environment. SAP Note 50088 will explain good in creating OPS4 users for windows environment.

But i can say that in above situatiaon first you have struggled with issue because of user is not in active mode(SAPSR3) , Here you need to perform the step alter user SAPSR3 status active to activate the user. But you did the password change, this is not a problem but you have not maintaining a encrypted password. If you want to maintain an encrypted password please change the same using brconnect command or alter user SAPSR3 identified by PASSWORD.

Regards

Nick Loy

[Former Member]

Yes it is windows environment.

I am able to unlock the user from Oracle' enterprise manager.

I have gone through 50088, everything as per this note was fine on my system.

Regarding password change, I changed the password in oracle as well as in database table using brconnect.

Well one more observation, this problem occurs when I install oracle without global DB creation.

If I create a global database at the time of oracle installation and stop the service later.

Everything works fine. Don't know why ...

Edited by: Ruhi Hira on Feb 9, 2009 12:28 PM

[Former Member]

Hi,

The SQL statement would look like:

update SAPR3.USR02 set UFLAG = 64 where MANDT = <client number> and BNAME != <don't lock user 1>

AND BNAME != <don't lock user 2>;

You can replace != with <> if you want. To run this from an OS command line, you would type:

Unix/Oracle 8---> sqlplus internal @<SQLpath+SQLname>

NT/Oracle 8.0---> plus80 internal @<SQLpath+SQLname>

NT/Oracle 8.1---> sqlplus internal @s<SQLpath+SQLname>

Unix/Oracle 9:--> sqlplus /nolog @<SQLpath+SQLname>

NT/Oracle 9-----> sqlplus /nolog @<SQLpath+SQLname>

In UNIX you can cron the script to schedule it. In NT you can schedule it as a task.

Or

I believe you havent used the right way to change the password of the database connect user SAPSR3 ,probably you have just changed it from the database level using an "alter user ..."

To allow continued logon of the R/3 work processes using the OPS$ mechanism, you must also change the password in the SAPUSER table. The simplest way of making a consistent change in the Oracle dictionary and in the

SAPSR3 table is to use the " -f chpass" option of brconnect, for example:

brconnect -f chpass -o sapsr3 -p <new_password>

Hope this will solve your issue. Also check the following notes for reference:

https://service.sap.com/sap/support/notes/562863

https://service.sap.com/sap/support/notes/400241

Note : Check the The account SYSTEM was locked : The reason for the account lock may be because you have changed the default profile of the database user 'SYSTEM'. And also brconnect error might have been changed ORA-28000 instead of ORA-01017.

Regards

Sreedhar Reddy

Edited by: Sreedhar Reddy on Feb 10, 2009 12:01 PM