How to unlock users using sql console on SAP Netweaver AS ABAP 7.5x

[AlbertoR]

Hello everybody,

I did some BASIS experiments with SAP Netweaver AS ABAP 7.5x that I think might help some other people who face the same situation I put myself in, so here is a little blog post to share them with you.

TLDR: I locked my users developer and SAP* on the demo machine "SAP Netweaver AS ABAP 7.5x". I managed to find a way to unlock them by using sql console.

A few time ago, I downloaded and managed to install on a VMware VM the "SAP NetWeaver AS ABAP Developer Edition 7.52 SP04".
I simply downloaded it here and followed the intructions available on the very same page for VWware. After a couple of hours I was done, and I had my own SAP VM nicely set up.
Using the same instructions, I also set up the clients on my Windows host: the good old SAP GUI and ADT for Eclipse.
Important: in the instructions, you also find all the predefined passwords for the users, i.e. SAP*, developer, bwdeveloper, DDIC. In my case, that password was "Down1oad" (without quotes).

I was using it proficiently, then for a while I did not need it, and few months passed.

Today I intended to use it again and I had a bad surprise: first of all, my developer user, for which I still remembered the new password I set, could not logon due to an expired license.
I searched the web and I found out how to renew the password here: logon using SAP* to client 000 and use transaction SLICENSE to upload a new licence file that you can get here.

OK, I said to myself, let's logon. I could not remember that I had all the nice passwords for all users on the very same guide for the installation that I downloaded few months ago.
I searched the web, and stumbled upon a guide for another version of the trial, here.
This version, did not have the same default password "Down1oad", but another one: "Appl1ance".
I used it to try to logon with SAP* and I locked it.

I could not use other users to logon because of the expired license.

So I told myself: let's use the DB console.
I did not even know which DB was installed on my box (I run the install.sh script few months ago and I was not really interested in the details behind it, but rather on the result).

I finally remember about the guide and I found there that the database is the SAP ASE and the SAP Database Admin user is sybnpl. It was created by the install.sh script that sets up SAP during the installation, and it has the password supplied to the script during the installation process. I remembered that password, luckily. You need to use that user, to run the command isql, which is the console.

And to reset the lock, in table USR02, you need to use the user SAPSR3, which is the SAP Schema User:

isql -USAPSR3 -X -SNPL

This will ask you for the password: once more it is the one provided to the install.sh script.

How did I find it out? Here are my commands just before the one show above:

1> use NPL

2> go

1> select * from USR02

2> go

Msg 208, Level 16, State 1:

Server 'NPL', Line 1:

USR02 not found. Specify owner.objectname or use sp_help to check whether the

object exists (sp_help may produce lots of output).

1> select * from SAPSR3.USR02

2> go

Msg 10330, Level 14, State 1:

Server 'NPL', Line 1:

SELECT permission denied on object USR02, database NPL, owner SAPSR3

1> exit

vhcalnplci /home/alberto% isql -USAPSR3 -X -SNPL

And at this point, when I did the "select *" over USR02, I magically got the list of users! 🙂 Bingo!

Then, I simpy did:

1> update USR02 set UFLAG=0 where BNAME='SAP*' and MANDT='000'

2> GO

(1 row affected)

All in all, this is rather simple, but I wanted to have a place where I could easily find again all these steps and share with the community, so if anybody else gets into the same trouble, it will be easy to solve it.

If you have any comment or question, please don't hesitate to contact me and I will be glad to answer and help!

Take care,

Alberto