# SAP Inactive Users ABAP Report Generator > Source: https://netray.co/tools/sap-inactive-users-abap-report-generator > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Fill in the inactivity threshold and user type to get a ready to paste ABAP report that lists dormant users from USR02. ## Category sap ## Erp SAP ECC and S/4HANA ## Audience - SAP security analyst - SAP Basis admin - ABAP developer ## Tool **Kind:** template **Output:** code **Language:** abap **Fields:** #### Report name **Key:** report_name **Type:** text **Default:** ZSEC_INACTIVE_USERS #### Inactive for more than (days) **Key:** days **Type:** number **Default:** 90 #### User type **Key:** ustyp **Type:** select **Options:** - A - B - C - S - L **Default:** A **Help:** A dialog, B system, C communication, S service, L reference #### Lock status filter **Key:** lock_filter **Type:** select **Options:** - uflag = 0 - uflag <> 0 - uflag >= 0 **Default:** uflag = 0 **Help:** uflag = 0 means not locked #### Author or team **Key:** author **Type:** text **Default:** SAP Security **Blocks:** #### Report source **Body:** REPORT {{report_name}}. " Purpose: list users inactive for more than the threshold " Author: {{author}} PARAMETERS p_days TYPE i DEFAULT {{days}}. TYPES: BEGIN OF ty_user, bname TYPE usr02-bname, ustyp TYPE usr02-ustyp, uflag TYPE usr02-uflag, erdat TYPE usr02-erdat, trdat TYPE usr02-trdat, END OF ty_user. DATA: lt_users TYPE STANDARD TABLE OF ty_user, ls_user TYPE ty_user, lv_cutoff TYPE d. lv_cutoff = sy-datum - p_days. SELECT bname, ustyp, uflag, erdat, trdat FROM usr02 INTO CORRESPONDING FIELDS OF TABLE @lt_users WHERE mandt = @sy-mandt AND ustyp = '{{ustyp}}' AND {{lock_filter}} AND ( trdat < @lv_cutoff OR ( trdat = '00000000' AND erdat < @lv_cutoff ) ) ORDER BY bname. IF lt_users IS INITIAL. WRITE: / 'No users found for the selection.'. RETURN. ENDIF. WRITE: / 'User', 20 'Type', 26 'Lock', 34 'Created', 48 'Last logon'. ULINE. LOOP AT lt_users INTO ls_user. WRITE: / ls_user-bname, 20 ls_user-ustyp, 26 ls_user-uflag, 34 ls_user-erdat, 48 ls_user-trdat. ENDLOOP. WRITE: / , / 'Users listed:', lines( lt_users ). #### Notes for the reviewer **Body:** Selection logic: users whose last logon date (TRDAT) is older than the cutoff, plus users that never logged on (TRDAT is initial) and were created before the cutoff. User type filter: {{ustyp}}. Lock filter: {{lock_filter}}. Threshold: {{days}} days. This report only reads data. Lock or delete users through SU01 or SU10 under your change process. **Notes:** USR02 stores logon data per client and TRDAT is the last logon date, which on some releases is not updated for every logon type (for example some RFC or web logons). Confirm the behaviour on your release and consider the Security Audit Log for a complete picture. Test in a non production client first. Release 7.40 and later syntax is used. ## Content **Intro:** Dormant users are one of the first things an auditor asks about. This generator produces a short ABAP report that reads USR02 and lists users who have not logged on for a number of days, so you can lock them through your normal change process. **Sections:** #### How to use the generator **Body:** Choose the inactivity threshold, the user type and the lock filter, then copy the generated code into SE38 and activate it. Run it per client. The first block is the report; the second block is a short description you can paste into your access review workpaper so reviewers know exactly how the list was produced. Start with dialog users, because system and communication users are often supposed to be silent on interactive logon. **Bullets:** - Create the report in a development system and transport it - Run in each productive client - Keep the output as audit evidence with the run date #### How the logic works **Body:** USR02 holds one row per user and client. TRDAT is the date of the last logon and ERDAT the creation date. A user with an initial TRDAT never logged on, so the report compares the creation date instead. UFLAG is the lock indicator and zero means not locked, which is why the default filter lists unlocked dormant accounts, the ones that present the real risk. Switch to the other filters to review already locked users that should be deleted. #### Limits and common mistakes **Body:** The last logon date can lag for some access paths, and users who only run through RFC or web access might appear inactive in TRDAT while still active. Cross check important IDs with the Security Audit Log or the statistics records before locking them. Do not lock interface users on the basis of this report alone, because their usage may not update the same field. **Bullets:** - Exclude known interface and emergency users by review, not by guess - Verify with the user's manager before deleting - Document the threshold in your access control policy **Cta:** If you maintain many such security reports across SAP systems, we can help turn them into a governed, read only reporting layer on your own infrastructure. **Faq:** #### Which table holds the last logon date in SAP? **Answer:** USR02 holds logon data per client, with TRDAT as the last logon date. SUIM reports on users by logon date use the same data. #### Why does a user with recent RFC activity show as inactive? **Answer:** Some access paths do not update the same last logon field. Cross check with the Security Audit Log or workload statistics before locking an interface or service ID. #### Can the report lock the users automatically? **Answer:** This version only lists them on purpose. Locking should follow your change and approval process. You can extend it with the BAPI for locking users after review. #### Does this work on S/4HANA? **Answer:** Yes, USR02 exists in S/4HANA. The inline declaration syntax requires ABAP 7.40 or later, which all S/4HANA releases support. ## Search terms sap inactive users report, sap users not logged in 90 days, usr02 trdat abap, sap dormant user report, abap list inactive users, sap user access review inactive, sap lock inactive users, sap usr02 select --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json