Locked user still receives logon attempts

What this finding means

Safe Decommission Preflight reports this finding with the default severity “Critical”.

About the engine: Unused Z-program, table, and interface retirement preflight

How ERP Preflight detects it

The analysis is deterministic: the same exported files and the same knowledge snapshot always produce the same findings. No SAP system connection is required — you upload exports.

Engine

Safe Decommission Preflight

Accepted formats

JSON, CSV, TEXT

What to export

Decommissioning extract: JSON {'target_type' (USER | TECHNICAL_USER | SERVICE_USER | COMMUNICATION_USER | JOB_STEP_USER | RFC_DESTINATION), 'target_user' or 'target_destination', 'evaluation_date', 'usr02': [...], 'tbtco': [...], 'tbtcp': [...], 'rfcdes': [...], 'swwwihead': [...], 'agr_users': [...], 'sm20': [...], 'scheduled_integrations': [...], 'ownership': [...]} or a sectioned CSV ([TARGET], [USR02], [TBTCO], [TBTCP], [AGR_USERS], [INTEGRATIONS], [OWNERSHIP], ...). Time-based rules require 'evaluation_date' (extract date); it is never taken from the system clock.

Required input

• target_user or target_destination
• per target type: USR02, TBTCO, RFCDES, SWWWIHEAD (users); + TBTCP (technical / job-step users); RFCDES + scheduled integration inventory (service / communication users, RFC destinations)
• evaluation_date for recency rules

Evidence

Each finding points to the artifact path, line and column, the code snippet and the SHA-256 of the uploaded file. Findings without such a pointer are demoted to confidence UNKNOWN.

Confidence

The verdict rests on your artifacts only. Each finding carries a confidence class (VERIFIED, RULE_DERIVED, INFERRED or UNKNOWN) that shows how strong the evidence is.

Target releases of the engine

S4H_2022, S4H_2023, S4HANA_CLOUD_2402, S4HANA_CLOUD_2408

Related findings

• CriticalRFC destinations log on with the user
• CriticalBackground job steps run under the target user (TBTCP)
• CriticalScheduled integrations depend on the target
• CriticalBackground jobs run under the user
• CriticalRFC destination to decommission absent from RFCDES
• CriticalCandidate user absent from USR02

Terms used on this page

• Work item
• System refresh

Background reading

• Why SAP Business Workflow items get stuck and how to find the causeThe typical reasons a workflow does not continue — no agent found, failed background steps, missing events, configuration gaps — and the standard tools to diagnose them.
• SAP system refresh checklist: BDLS logical system conversion and RFC outbound isolationWhy a quality assurance system refresh from production risks sending live IDocs, emails or RFC calls to production partners, and how to verify post-copy delta settings deterministically.