SAPFree generatorPDF, Excel, Word exportSAP ECC and S/4HANA

SAP Inactive Users ABAP Report Generator

Dormant users are one of the first things an auditor asks about. This generator produces a short ABAP report that reads USR02 and lists users who have not logged on for a number of days, so you can lock them through your normal change process.

Fill in

Report name

Inactive for more than (days)

User type

A dialog, B system, C communication, S service, L reference

Lock status filter

uflag = 0 means not locked

Author or team

Generated code

Download:

Report source

REPORT ZSEC_INACTIVE_USERS.
" Purpose: list users inactive for more than the threshold
" Author: SAP Security

PARAMETERS p_days TYPE i DEFAULT 90.

TYPES: BEGIN OF ty_user,
         bname TYPE usr02-bname,
         ustyp TYPE usr02-ustyp,
         uflag TYPE usr02-uflag,
         erdat TYPE usr02-erdat,
         trdat TYPE usr02-trdat,
       END OF ty_user.

DATA: lt_users  TYPE STANDARD TABLE OF ty_user,
      ls_user   TYPE ty_user,
      lv_cutoff TYPE d.

lv_cutoff = sy-datum - p_days.

SELECT bname, ustyp, uflag, erdat, trdat
  FROM usr02
  INTO CORRESPONDING FIELDS OF TABLE @lt_users
  WHERE mandt = @sy-mandt
    AND ustyp = 'A'
    AND uflag = 0
    AND ( trdat < @lv_cutoff
          OR ( trdat = '00000000' AND erdat < @lv_cutoff ) )
  ORDER BY bname.

IF lt_users IS INITIAL.
  WRITE: / 'No users found for the selection.'.
  RETURN.
ENDIF.

WRITE: / 'User', 20 'Type', 26 'Lock', 34 'Created', 48 'Last logon'.
ULINE.
LOOP AT lt_users INTO ls_user.
  WRITE: / ls_user-bname, 20 ls_user-ustyp, 26 ls_user-uflag,
           34 ls_user-erdat, 48 ls_user-trdat.
ENDLOOP.

WRITE: / , / 'Users listed:', lines( lt_users ).

Notes for the reviewer

Selection logic: users whose last logon date (TRDAT) is older than the cutoff, plus users that never logged on (TRDAT is initial) and were created before the cutoff.
User type filter: A. Lock filter: uflag = 0.
Threshold: 90 days.
This report only reads data. Lock or delete users through SU01 or SU10 under your change process.

USR02 stores logon data per client and TRDAT is the last logon date, which on some releases is not updated for every logon type (for example some RFC or web logons). Confirm the behaviour on your release and consider the Security Audit Log for a complete picture. Test in a non production client first. Release 7.40 and later syntax is used.

Automate your SAP access reviews

Optional: talk to us about a read only reporting layer for user and role reviews.

Optional. The tool and every export work without this. No spam.

How to use the generator

Choose the inactivity threshold, the user type and the lock filter, then copy the generated code into SE38 and activate it. Run it per client. The first block is the report; the second block is a short description you can paste into your access review workpaper so reviewers know exactly how the list was produced. Start with dialog users, because system and communication users are often supposed to be silent on interactive logon.

Create the report in a development system and transport it
Run in each productive client
Keep the output as audit evidence with the run date

How the logic works

USR02 holds one row per user and client. TRDAT is the date of the last logon and ERDAT the creation date. A user with an initial TRDAT never logged on, so the report compares the creation date instead. UFLAG is the lock indicator and zero means not locked, which is why the default filter lists unlocked dormant accounts, the ones that present the real risk. Switch to the other filters to review already locked users that should be deleted.

Limits and common mistakes

The last logon date can lag for some access paths, and users who only run through RFC or web access might appear inactive in TRDAT while still active. Cross check important IDs with the Security Audit Log or the statistics records before locking them. Do not lock interface users on the basis of this report alone, because their usage may not update the same field.

Exclude known interface and emergency users by review, not by guess
Verify with the user's manager before deleting
Document the threshold in your access control policy

Frequently Asked Questions

Which table holds the last logon date in SAP?

USR02 holds logon data per client, with TRDAT as the last logon date. SUIM reports on users by logon date use the same data.

Why does a user with recent RFC activity show as inactive?

Some access paths do not update the same last logon field. Cross check with the Security Audit Log or workload statistics before locking an interface or service ID.

Can the report lock the users automatically?

This version only lists them on purpose. Locking should follow your change and approval process. You can extend it with the BAPI for locking users after review.

Does this work on S/4HANA?

Yes, USR02 exists in S/4HANA. The inline declaration syntax requires ABAP 7.40 or later, which all S/4HANA releases support.

If you maintain many such security reports across SAP systems, we can help turn them into a governed, read only reporting layer on your own infrastructure.

Talk to an Expert Explore More Free Tools

Related Tools

SAP

More SAP tools

See all

Back to All Tools