Question:
You should remove SU01 from the menu of the role if people assigned to that role should not get it. If you deactivate the auth objects they still have access to SU01 but would be restricted based on the auth object you restricted. You should remove the txn and the linked (SU24) objects would disappear as well. If some people need SU01 then you should create another role. Look at SU01D if they need to see only
Answer:
Hi,
Thanks Rob for your reply. I have deleted the SU01 from Administration tree under Tools Menu. But still SU01 exists under many other Menus and Submenus like Logistic, Accounting etc.
Its a real pain searching SU01, delete that node from menu, save and generate profile then again find SU01 and do the same exercise again and again till it totally clear out.
Is there any other way to delete SU01 Node from all the Menus at one time.
Regards
Moon
Answer:
If you have removed S_USER_GRP from all the roles and profiles of the user, they will not be able to run SU01. Are you sure the objects you mention have been removed from _all_ roles assigned to the user?
Answer:
Hi,
Yes I have removed S_USER_GRP from that role. I have checked again thoroughly and found that at one place it was activated which was enabling user to perform SU01 tasks.
Now I am trying to remove SU01 tcode from User Menu as it exists in many places as I described in my earlier message in the same post.
Regards
Moon
Answer:
Not sure how you built your roles. The way you descibed it, you need to delete each one. Or if you re build you can just enter the transactions once in the menu and maintain the auth objects. (Run SUIM to see what txn the role has access to and import those txn. Then maintain the AUTH Objects. This implies that you are maintaining SU24. Users have the option to use the SAP_MENU or the USER MENU to get to txn. This way the txn will only be there once in the USER MENU and is less confusing for the user.
Answer:
Hi Rob,
Thanks for your suggestions. Actually I am a basis guy not a security admin, so just trying to do whatever I can as per client's requirement.
I have removed the Su01 nodes from all the menus. Now user won't even see those nodes through that role.
Thanks again.
Regards
Moon
Answer:
Just wondering if there are any profiles in place on the user master records that are over-riding the roles?
_________________
Real Daleks don't use the stairs. They just level the building.