WF-BATCH requires SAP_ALL & SAP_NEW profiles

[Aydin, Kemal (Kemal)** CTR **]

Lisa,
 
I've worked on several environments with similar requirements ( no SAP_ALL / SAP_NEW ). At the beginning, it sounds like a good idea ( and a secure one ). But, WF-BATCH user will be accessing several areas that would be hard to trace and many requests will become HIGH priority in your prod. environment when you hit a security wall. And, teams will start pointing fingers in case of a production down problem :-) !!!!
 
Unless you have a very quick response time from the security team, and a production like environment where you can test all scenarios before you hit the production environment, it would be a good idea to keep SAP_ALL & SAP_NEW.
 
Since WF-BATCH is a background user, none of your users will have access to SAP_ALL / SAP_NEW.
 
Regards,
Kemal Aydin
 
> -----Original Message-----
>> From: Lisa Hasenbohler [SMTP:lhasenbo at agrium.com]
> Sent: Tuesday, May 14, 2002 4:30 PM
> To:   SAP-WUG at MITVMA.MIT.EDU
> Subject:      WF-BATCH requires SAP_ALL & SAP_NEW profiles
>
> Hi All,
>
> It is recommended that system user WF-BATCH be assigned SAP_ALL and SAP_NEW, however, our policy is that SAP_ALL or SAP_NEW should only be used in the Production Environment when absolutely necessary (even for non-dialog users).
>
> Before I go and attempt to build a new role or profile for WF-BATCH, I thought I would ask if anyone has developed or attempted to develop their own role/profile for WF-BATCH and if they could share their experience with me.
>
> Thanks,
> Lisa Hasenbohler