# Epicor Kinetic: Menu Item Missing or Access Denied for a User > Source: https://netray.co/erp-help/epicor-kinetic-menu-item-missing-security-fix > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: ERP Help ## Short answer When an Epicor Kinetic user cannot see a menu item or gets an access denied message, the cause is nearly always security: the user's security group lacks access to that menu or program, the user is not linked to the company, the license or module is not available, or a menu customization hides the item. Check each in that order. ## Kind error ## System epicor ## Erp Epicor Kinetic ## Module System Management / Security ## Query Epicor user cannot see menu item or program access denied ## Alternate Queries - Epicor menu option missing for user - Epicor you do not have security rights to this program - Epicor Kinetic user cannot open Job Entry - Epicor security group menu access setup ## Applies To Epicor Kinetic 2021.x to current and Epicor ERP 10.x; menu, security group and company access settings (screen names can vary by version) ## Steps ### Diagnose menu and program access **Items:** - Confirm the user is in the correct company. Log out and back in selecting the company, and check User Account Maintenance for the company list on the user. - In User Account Maintenance, review the user's security group assignments and note whether they belong to the group that should own the program. - Open Security Maintenance (or Menu Security Maintenance) and find the menu item. Check whether the group and the company have access granted. - Check the parent menu folder too. If a folder is not granted, its child items are hidden even when the child has access. - Check that a module or license is available. If the module is not licensed or enabled for the company, the menu item may not display at all. - Look for a customized menu: Menu Maintenance may hide, move or rename an item on a user or group level. - Ask the user to clear their local cache or refresh their client, then sign in again to rule out stale menu data. - If the menu shows but the program refuses to open, check method security for the underlying business object, and any BPM directive that blocks access. ## Sections ### How Epicor decides what a user sees **Body:** Epicor layers several controls. First, the company: a user only sees what exists for companies they are linked to. Second, the menu itself, which is a tree of folders and programs, each with a security ID. Third, security groups that grant access to menu IDs. Fourth, per-method security on the business objects behind the screen. A failure at any level looks to the user like a missing or broken menu. Because these are separate, the fix depends on where the symptom is. A missing menu item is a menu level issue. An item that is visible but throws an access error is almost always a business object or method level issue. ### Menu hidden versus program denied **Body:** If the item does not appear at all, work through company, group, menu security and licensing. This is the frequent case when a new hire is cloned from a template user that lacks a group, or when a new module was added to the menu but nobody granted the group. If the item appears and clicking it opens an error, note the exact wording. Messages about not having rights to a method or service point to business object security. A message from a custom rule points to a Method Directive or customization. The text decides where to look next, so capture it exactly. ### Granting access without over-granting **Body:** Prefer giving the user a role based security group over editing individual rights. A group per job role, such as Production Planner or AP Clerk, keeps audits tractable and makes new hires a one-step setup. Avoid granting everything to fix one complaint. Over-broad grants are how users end up able to release jobs, post invoices or edit master data they should not touch. Use the least access that works, record the reason in your change log, and test with the user's real account or an equivalent test user. **Code:** -- Read-only check: which security groups is a user in? (run on a reporting copy; table names vary by version) SELECT UserID, SecurityGroupID FROM Ice.UserSecGrp WHERE UserID = 'JSMITH'; ### Before and after: audit what changed **Body:** After any security change, test as the user, or have them test, from a fresh login. Confirm they can do the task and cannot do tasks outside their role. Keep a record of old and new group membership. If menu problems reappear after an upgrade or a company copy, compare the menu and security data between environments. Imported menus can overwrite customizations, and copied companies may lack the company links the user had before. ## Pitfalls - Granting a security group full access to make a complaint go away, and breaking segregation of duties. - Forgetting that a hidden parent folder hides every child item. - Fixing the symptom for one user and not the template or group, so the next hire has the same issue. - Ignoring method level security when the menu is visible but the program errors. - Testing as an administrator, who sees everything, and concluding it works. ## Ai Angle An assistant grounded in your Epicor security configuration can answer who has access to a given program, show which group and company grants it, and explain why a particular user does not see it, all read-only and under the asker's own role. It does not edit security. A security administrator makes the change, and the assistant can draft the request with the exact group and menu ID. ## Faq ### Why can a user see a program in Epicor but not open it? **Answer:** The menu grants visibility, but the business object behind the screen enforces its own method security. A user can see Job Entry yet lack rights to a method it calls. Read the error text, then check the security group's method level rights for the named service, and any Method Directive that blocks the action. ### How do I copy a user's security in Epicor? **Answer:** Create the new account in User Account Maintenance and assign the same security groups and companies as the model user, or use a template user if your site has one. Review the result rather than copying blindly, because the model user may carry rights that were added for a one-off need. ### Does an Epicor license affect menu visibility? **Answer:** Yes. Menu items for modules the company is not licensed for, or has not enabled, may not appear regardless of security group. Check the licensed modules and company configuration before adjusting groups, especially after adding a new module or restoring to a different environment. ### Where do I change which menu folder a program is in? **Answer:** Use Menu Maintenance. Be careful, because a moved item keeps its security ID, so access follows the program, but the parent folder access still applies. Document changes and re-test with a non-administrator account after moving items. ## Search terms epicor menu item missing, epicor security group access, epicor access denied program, epicor menu maintenance, epicor security maintenance, epicor user account maintenance, epicor method security, epicor kinetic user permissions, epicor cannot see menu --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json