# SAP Profile Parameter Change Log Worksheet

> Source: https://netray.co/tools/sap-profile-parameter-change-log-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

An editable log of SAP profile parameter changes with old and new values, reason, approver and restart requirement.

## Category

sap

## Erp

SAP ECC / S/4HANA

## Audience

- SAP Basis admin
- IT auditor

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### Date

**Key:** date

**Type:** date

#### SID

**Key:** sid

**Type:** text

#### Parameter

**Key:** param

**Type:** text

#### Old value

**Key:** old

**Type:** text

#### New value

**Key:** new

**Type:** text

#### Method

**Key:** method

**Type:** select

**Options:**

- RZ10 profile
- RZ11 dynamic
- Instance profile file
- Default profile

#### Restart needed

**Key:** restart

**Type:** select

**Options:**

- Yes
- No
- Dynamic

#### Reason

**Key:** reason

**Type:** text

#### Approver

**Key:** approver

**Type:** text

#### Change ticket

**Key:** ticket

**Type:** text

**Rows:**

**Date:** 2026-09-02

**Sid:** PRD

**Param:** login/min_password_lng

**Old:** 6

**New:** 12

**Method:** Default profile

**Restart:** Yes

**Reason:** Align with password policy

**Approver:** S. Meyer

**Ticket:** CHG-5541

**Date:** 2026-09-02

**Sid:** PRD

**Param:** login/fails_to_user_lock

**Old:** 12

**New:** 5

**Method:** Default profile

**Restart:** Yes

**Reason:** Tighten lockout per policy

**Approver:** S. Meyer

**Ticket:** CHG-5541

**Date:** 2026-09-16

**Sid:** PRD

**Param:** rdisp/gui_auto_logout

**Old:** 0

**New:** 3600

**Method:** Default profile

**Restart:** Yes

**Reason:** End idle GUI sessions after one hour

**Approver:** S. Meyer

**Ticket:** CHG-5602

**Date:** 2026-10-01

**Sid:** QAS

**Param:** login/password_expiration_time

**Old:** 0

**New:** 90

**Method:** RZ10 profile

**Restart:** Yes

**Reason:** Test policy before production

**Approver:** R. Kumar

**Ticket:** CHG-5630

**Totals:**

#### Changes logged

**Key:** param

**Agg:** count

**Format:** integer

**Notes:** Record the profile and instance where the parameter is set. Whether a parameter is dynamic or needs a restart depends on the parameter and release, so confirm in the parameter documentation (RZ11) before planning the change window. Always keep a copy of the previous profile version.

## Content

**Intro:** Profile parameters control password rules, session timeouts and many other security settings. If a parameter is changed and nobody can say when or why, an audit gets difficult quickly. This log keeps the trail.

**Sections:**

#### How to use the log

**Body:** Add a row each time a profile parameter changes. Record the system, the parameter name, the old and new value, the method used and whether a restart was needed. Always include the change ticket and approver. Transaction RZ10 maintains profile files with versions, and RZ11 shows documentation and can change dynamic parameters until the next restart. A dynamic change in RZ11 is lost on restart unless the profile is updated too, so log both steps.

**Bullets:**

- One row per parameter per system
- Log the dynamic change and the permanent profile change separately
- Record the restart requirement before the change window
- Keep the ticket number in every row

#### Parameters worth watching

**Body:** Common security-relevant parameters include login/min_password_lng, login/password_expiration_time, login/fails_to_user_lock, login/fails_to_session_end, login/no_automatic_user_sapstar, rdisp/gui_auto_logout and auth/rfc_authority_check. Your own baseline should state the target value for each. Compare the live value in RZ11 against the baseline, and record any exception with approval. Do not copy values from a blog without checking them against your policy and release.

#### Using the log in an audit

**Body:** Auditors ask whether the setting matches policy and whether changes were approved. Filter the exported sheet by parameter to show the history of one setting. If a value in the system differs from the last log entry, someone changed it outside the process, which is a finding in itself. Profile version history in RZ10 gives a second source for the same story.

#### Common mistakes

**Body:** Typical errors are changing a parameter dynamically and forgetting to make it permanent, setting different values across instances without noting it, and changing production first. Another is lowering a lockout or timeout value without warning interface owners whose technical users may be affected.

**Cta:** If you want live parameter values compared against your baseline automatically, Netray can build read-only checks that run on your own infrastructure.

**Faq:**

#### What is the difference between RZ10 and RZ11?

**Answer:** RZ10 maintains the profile files, which apply after restart. RZ11 displays parameter attributes and documentation and can change dynamic parameters immediately, though that change does not persist across a restart.

#### Should I log changes to non-production systems?

**Answer:** Yes, at least for parameters that you plan to move to production. It documents testing and avoids differences between systems.

#### Where do I get the target values?

**Answer:** From your own security baseline or password policy, informed by SAP security guidance for your release. This sheet only records changes, it does not define policy.

#### Can this replace profile version history?

**Answer:** No. RZ10 version history is the system record. This log adds the reason, approver and ticket that the system does not hold.

## Search terms

sap profile parameter change log, sap rz10 change documentation, sap rz11 parameter log template, sap basis parameter change tracker, sap security parameter baseline excel, login fails_to_user_lock change log, sap profile parameter audit

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json