SAP* User enable and desable issues

[Former Member]

Hello sap community,

I've recently installed a SAP EHP7 ERP 6.0 with SQL database to do a LAB test.

But i am having a peculiar problem with the parameter used to disable or enable the user SAP* (login/no_automatic_user_sapstar).

What i need is to enable SAP* to log in to the client I created as a LAB. To do that i added the parameter login/no_automatic_user_sapstar in the DEFAULT profile with value 0 (value 0 is to enable logging in with the user right?). Then I restarted the instance. Then i tried to log in with SAP* and the password "pass" but the system tells me the user or password is wrong.

To troubleshoot I tried deleting the parameter of the default profile and add it in the Instance profile, without luck.

Then i deleted the parameter from both profiles. Then using TCODE SU01 said the user SAP* was locked due to many login attempts, so I unlocked it and tried to log in with it (using default password "pass) and of course it didn't work because the parameter was not set on any of the profiles, but then i went in to SU01 again and reset the password for SAP* to Password1 and doing that i was able to log in .

Why was i able to log in, even though i dont have the parameter set in any of the profiles?

Why the parameter have no effect in any of the profiles with either value 0 or 1?

And why I can reset the password of SAP* and log in with it, even though there is no parameter enabling the use of this user? and no one has created a user SAP*.

[tanmeya_mohan]

Hello Galan,

User SAP* has password "pass" only for newly created clients using transaction SCC4, not for the clients that are already delivered as a part of standard installation / build by SAP.

If you were trying to login to client 000, 001 or 066 after fresh system install, the password for SAP* user would be the master password you provided during the installation procedure in SAP SWPM.

SAP* is not required to be manually created after a fresh system install, it rather exists as a standard user.

You may refer the below for details on standard users -

Protecting Standard Users - SAP NetWeaver Application Server ABAP Security Guide - SAP Library

Hope this helps.

Thanks & Best Regards,

Tanmeya

[Former Member]

Hello Galan,

To activate emergency user the profile parameter login/no_automatic_user_sapstar is applicable for instance profile only, when you add this parameter in default profile from RZ10 it would go to unknown parameter and kernel would not allow this. So to enable/disable sap* parameter is to used in instance profile only.

As of release 7.0 or higher default value of parameter is change to 1 from 0. To activate the sap* value must be set to 0

After deleting the parameter, did you check

a.) RZ11 -> what is current value shown for parameter

b.) Did you check the change history of parameter by doing following

Go to RZ10

Choose the profile.

Go to Extended maintenance

Choose - Display.

Then Select Go TO - Detailed List

Again Click  Go to- Detailed List

You can see the history of the parameter change.

Check above and based on information you see, it would have answers to your questions.

Regards

ksk