Last time a deleted user accessed the system

[chris_hall2]

Is there any way of finding out when a user that has been deleted from the system access the system?

I use STAT for active ID's but this does not work for inactive ID's.

Thanks,

Chris

[Former Member]

Hi,

Checkout the link.

Regards

Rakesh

[chris_hall2]

Thanks for the link. This does not appear to help out that much as those other tables don't show the last activity date.

I have now been a frequent user of the USH02 and USH04 tables for deleted user id's but these do not contain the last activity date.

Any other ideas?

[Former Member]

Chris

I cant understand this... when a user is deleted from the system then how can he access the the system..

Try to execute the report RSUSR200 you will find the last logon of the user and that will confirm you the date and time he last used the system.

Regards

Rakesh

[Former Member]

Hi Chris,

I think the answer lies in USH02.

Look closely at USH02 for the deleted user, there will be an entry of the last logged in date, including the last time.

In the last date entry, check for user with entry to tcode: KRNL and Program: SAPMSYST. That time stamp is the entry of the last login of the user. SAP writes this entry form USR02 to USH02 before it deletes the record for the user. USR02 will no longer have an entry, hence SUIM will not give anything against it.

USH04 will give you when was the user deleted.

Hope this helps

Cheers

Abhishek

Off to home

[chris_hall2]

An example being someone goes on Maternity Leave say June 1, 2007. We then notice inactivity on the account and remove August 1, 2007. For audit purposes we are then asked to show that this person never access the system between June 1 and August 1.

[chris_hall2]

You are awesome Abhishek. That is what I was looking for. Looking through my ADM course books I couldn't find anything on this.

That is exactly what I'm looking for.

Thanks,

Chris

[chris_hall2]

Alright, I think I have an issue. I'm seeing this line up for most users however on someof them not even close.

I have a user that I'm seeing processed PO's after the date of the KRNL appearing in the table. Why would this be?

[Former Member]

Thanks for the information Abhishek,

I found KRNL Tcode and SAPMSYST program against a user who was deleted on say 01 feb 08 . But in USH04 i found that there were some changes made to the user master after the deletion date and there is no such column in USH04 where in you will find that user was deleted.

But when i cross checked in SUIM for the deleted users i found the user was deleted on 01 feb 08.

My question is wthr by checking KRNL tcode and SAPMSYST program against a user confirms that user was deleted on that date.?

Thanks

Rakesh

[Former Member]

Hi Rakesh,

Report RSUSR200 reads from USR02, which only pertains to active users.

>

> I found KRNL Tcode and SAPMSYST program against a user who was deleted on say 01 feb 08 . 
> My question is wthr by checking KRNL tcode and SAPMSYST program against a user confirms that user was deleted on that date.?

USH02 does not tell you the date when the user was deleted. It only tells the last time the user logged in the system.

USH04 will tell when was the user deleted. Since a user cannot login to the system once deleted, USH04 timestamp will be greater than USH02. i.e. the user was deleted after the last login.

Hope this clarifies

Thank you

Abhishek

[Former Member]

Thanks Abhishek

[chris_hall2]

It appears that the KRNL line item is in line with the last time the user changed their password and not the last logon. Am I missing something?

Thanks,

[Former Member]

Hi Chris,

Yeap! You are right, it does appear to me that this is the time the last password was changed. My apologies to you both and THANK YOU Chris for correcting me. Wish I could give you points.

However, it did strike to me that this can actually be dug up using transaction STAD which is specifically for this. In STAD you can also get what transactions were run during the last logon. The last login is when SESSION_MANAGER was run. All activities can also be found.

Chris, try tcode STAD. The only problem is max read time is only 24 hours for this. So if you have a period in mind, this would work great.

Tcode STAD-> give a start date> start time: 00:00:00>read time: 24:00:00

Let me know how it goes.

Thank you

Abhishek

[Former Member]

Hi, I read the thread. But I think STAD gives only LAST 24 hours details, not earlier than that.

[chris_hall2]

Solution doesn't appear to be lining up.

[Former Member]

Yes Chris you are right..

KRNL is for password change and SAPMSYST program is to disable the dialog logon and because the SAPMSYST progam is edited and the user no longer is able to logon into the system.(hence you can say that the user no longer has the access to system)

Correct me if i am wrong.

Thanks

Rakesh.

[Former Member]

The intended tool for this is SM20 (the Security Audit Log).

If your log and system is configured correctly, it will show you all successfull logons of all types, including date and time stamps, on all servers.

Cheers,

Julius

[Former Member]

Hi Julius,

Thanks for that

Our systems do not have the audit log enabled. So is STAD the only way out? Or do you think there is an alternative?

Thank you

Abhishek

[Former Member]

Hi Abhishek,

The usefullness of STAD / STAT / ST03N is not to be underestimated, but it's usefullness for auditing is purely co-incidental and not reliable. They rename, aggregate and ignore some of the data, particularly after a period of about a day, after which time only the collected statistics (configurable in ST03(N)) remain.

You could try to put logon information together again from that, but you would be wasting your time (in my opinion). You will never find the last one...

SM20 is the correct tool to use. If you need to run it for all users on all servers to get the information for deleted users, you can always recreate the user from the address data.

Cheers,

Julius

[chris_hall2]

So trying to get into SM20, the following error appears, "Command with status BACK is not supported" Message no. SL 161

STAD is not pulling in any information even when I know a deleted user created a PO on a specific day.

[Former Member]

You are most likely missing authorizations to read the log... S_ADMI_FCD = AUDD

(see SAP notes 1140703, 1118397 and 766771).

Cheers,

Julius

[Former Member]

Hi Julius,

Thanks for this info

Will work this approach.

Regards

Abhishek