SAP Profile Parameter Change Log Worksheet
Profile parameters control password rules, session timeouts and many other security settings. If a parameter is changed and nobody can say when or why, an audit gets difficult quickly. This log keeps the trail.
| Date | SID | Parameter | Old value | New value | Method | Restart needed | Reason | Approver | Change ticket | |
|---|---|---|---|---|---|---|---|---|---|---|
Record the profile and instance where the parameter is set. Whether a parameter is dynamic or needs a restart depends on the parameter and release, so confirm in the parameter documentation (RZ11) before planning the change window. Always keep a copy of the previous profile version.
Compare live parameters against your baseline
Optional: we can discuss a read-only check of SAP parameters against your security baseline.
Optional. The tool and every export work without this. No spam.
How to use the log
Add a row each time a profile parameter changes. Record the system, the parameter name, the old and new value, the method used and whether a restart was needed. Always include the change ticket and approver. Transaction RZ10 maintains profile files with versions, and RZ11 shows documentation and can change dynamic parameters until the next restart. A dynamic change in RZ11 is lost on restart unless the profile is updated too, so log both steps.
- One row per parameter per system
- Log the dynamic change and the permanent profile change separately
- Record the restart requirement before the change window
- Keep the ticket number in every row
Parameters worth watching
Common security-relevant parameters include login/min_password_lng, login/password_expiration_time, login/fails_to_user_lock, login/fails_to_session_end, login/no_automatic_user_sapstar, rdisp/gui_auto_logout and auth/rfc_authority_check. Your own baseline should state the target value for each. Compare the live value in RZ11 against the baseline, and record any exception with approval. Do not copy values from a blog without checking them against your policy and release.
Using the log in an audit
Auditors ask whether the setting matches policy and whether changes were approved. Filter the exported sheet by parameter to show the history of one setting. If a value in the system differs from the last log entry, someone changed it outside the process, which is a finding in itself. Profile version history in RZ10 gives a second source for the same story.
Common mistakes
Typical errors are changing a parameter dynamically and forgetting to make it permanent, setting different values across instances without noting it, and changing production first. Another is lowering a lockout or timeout value without warning interface owners whose technical users may be affected.
Frequently Asked Questions
What is the difference between RZ10 and RZ11?
RZ10 maintains the profile files, which apply after restart. RZ11 displays parameter attributes and documentation and can change dynamic parameters immediately, though that change does not persist across a restart.
Should I log changes to non-production systems?
Yes, at least for parameters that you plan to move to production. It documents testing and avoids differences between systems.
Where do I get the target values?
From your own security baseline or password policy, informed by SAP security guidance for your release. This sheet only records changes, it does not define policy.
Can this replace profile version history?
No. RZ10 version history is the system record. This log adds the reason, approver and ticket that the system does not hold.
If you want live parameter values compared against your baseline automatically, Netray can build read-only checks that run on your own infrastructure.
Related Tools
SAP System Landscape Inventory Worksheet
An editable inventory of your SAP systems and clients: SID, tier, release, database, owner and patch dates. Exports to Excel.
SAPSAP Security Incident Report Template
A structured incident report for suspicious SAP activity such as misused accounts, unexpected RFC calls or unauthorized changes.
SAPSAP Go-Live Security Readiness Checklist
A checklist of security and Basis items to confirm before an SAP system or release goes live, with critical items flagged.
SAPSAP Role Change Request Form Template
A fill-in change request for adding or removing authorizations in an SAP role, with SoD check and test evidence sections.
More SAP tools
See all- SAP Sales Document Types Reference
- SAP Pricing Procedure Design Worksheet
- SAP Item Category Determination Reference
- SAP Delivery Block Reasons Template
- SAP Credit Management Checklist
- SAP Output Determination Checklist
- SAP Billing Types Reference
- SAP Incompletion Log Checklist
- SAP SD Tables Reference (VBAK, VBAP, LIKP, VBRK and More)