Mass Transport Owner Changes

[682638]

Dear Experts,

I need your help to identify the root-cause of one Issue which I came across recently and which has become a serious issue for me.

One day when I logged in into SAP Development Golden client, I observed that all the 'Modifiable' transport's (both Customizing and Workbench) OWNER and DESCRIPTION has changed for almost 45 transports. This change has resulted in giving same 'owner' and same 'description' to all these 45 transports. Surprise part is that all these changes has happened at the same date and same time for all TRs, which indicates that it has happened through some background change program. No log is available for who has done this.

Please guide to identify the root-cause of this issue.

Thanks

SZA

[Sandra_Rossi]

I don't think you can if you didn't activate the SolMan change documents or SCU3 log for the TRs.

[naveen_k1]

Hi,

To investigate and determine the root cause of the unexpected changes to the owner and description fields of transport requests in your SAP Development Golden client, follow these steps:

1. Review Transport Management System (TMS) Configuration:

   • Check the TMS configuration for any automatic scripts or batch jobs that might be scheduled to run changes on transport requests. Look specifically for jobs that can update transport request properties.

2. Check for Scheduled Background Jobs:

   • In the SAP system, use transaction code SM37 to review the job logs around the time when the changes were made. Look for any jobs that involve programs or scripts that can modify transport request data.

3. Examine User and Authorization Changes:

   • Check if there were any recent changes in user roles and authorizations that might have inadvertently allowed unauthorized access or execution of scripts that could modify transport requests. Use transaction code SUIM to query user changes and role assignments.

4. Consult Change Documents:

   • Use transaction codes like SCU3 to access table change documents. Look for changes made to relevant tables like E070 (Transport Header) and E071 (Transport Object List). This can help identify if there was a direct modification to the database tables.

5. Audit Logs:

   • Check the security audit log (transaction SM19 for configuration and SM20 for analysis) to see if any suspicious activities were recorded around the time the changes were made.

[sziaabbas]

Dear Experts

Can I have your opinion on the mentioned issue?

Regards

[Sandra_Rossi]

Please do not post a solution. Instead, click on "show replies" then "comment".

[Sandra_Rossi]

I don't think you can if you didn't activate the SolMan change documents or SCU3 log for the TRs.

[sziaabbas]

Point Noted. Thanks