Mass change your SAP passwords
The short version: Here is a script to automate changing your SAP password across many systems. The long version follows…
One of the little annoyances I have to put up with as an SAP (yes, it’s “an”, because you’re supposed to say “ess-ay-pee.”) consultant, is when it becomes necessary to change passwords. That is because you need to be able to remember your passwords across all systems, which means it’s a good idea to use one password on all of them, meaning that when you change your password on one system, you change it everywhere. Some people devise strategies like combining the month with the system ID or something like that, which is just not very secure.
When I look at documentation on SAP’s websites, it seems perfectly possible to set up an SAP system for Windows Integrated (NTLM) authentication, so one may wonder why even put up with this schlepp. I imagine companies generally dislike that solution, because the extra layer of authentication is seen as a necessary security measure, while there are other factors, like people with several IDs, etc. Besides, end users may need to log on to at most 2 SAP systems in most cases, so it’s only really a problem for developers and configurers.
At the client where I am working now, I have been granted access to around 20 SAP clients across various systems. Now to update all of those every time I’m prompted to change my password on one system would become an incredibly tedious task. This has prompted me to write a vbs script to automate changing passwords across a whole number of systems. Building on something I found on the internet, I created a script that prompts you for your current password, and a new password, after which it will attempt to change your password on all given systems, provided you have sufficient RFC authorization on each.
The script calls function module SUSR_USER_CHANGE_PASSWORD_RFC, provided it exists on the system to change the password. The file produces an output file called passchangelog.txt in the directory (Windows: folder) where it is run giving a log of the actions taken. You could of course modify the script to give the output to standard out, but that would mean running it with cscript, and I think wscript is the default on a Windows installation.
To use the script, copy and paste it into a text file and rename it to something with a .vbs extension. You then modify the script where indicated, adding a line for each system for which you want your password to be changed. Make sure your password is the same on each system to begin with, so don’t inadvertently log yourself out of any of them!
I have also used a modified version of the script to just log on to each system to check whether I have an initial password there. You could probably even create a macro in Excel using it so that you read the system entries from a worksheet. I will leave that up to you.
Here is what it looks like:
Set ctlLogon = CreateObject("SAP.LogonControl.1") Set funcControl = CreateObject("SAP.Functions") Set objFileSystemObject = CreateObject("Scripting.FileSystemObject") '''Obtain current and new password from user currpass = InputBox("Enter current password") newpass = InputBox("Enter new password") ''Initialize variables Set outFile = objFileSystemObject.CreateTextFile("passchangelog.txt", True) ''' For each system, call subroutine to log on to system and change password ''' Parameters are: hostname, system id, system no., client, language, user ''' ADD A LINE PER SYSTEM FOR WHICH YOU WANT TO CHANGE YOUR PASSWORD Logon "host1.company.com", "KK1", "00", "010", "EN", "MYUSER" Logon "host2.company.com", "KK2", "00", "200", "EN", "MYUSER" Logon "host3.company.com", "KK3", "00", "300", "EN", "MYUSER" ''' Cleanup outFile.Close Set outFile = Nothing Set ctlLogon = Nothing Set funcControl = Nothing Set objFileSystemObject = Nothing '''***** Log on to system and change password ***** Sub ChangePass(appserver, sysid, sysno, client, lang, user) ''' Establish new connection Set objConnection = ctlLogon.NewConnection ''' Set logon details objConnection.ApplicationServer = appserver objConnection.System = sysid objConnection.SystemNumber = sysno objConnection.client = client objConnection.Language = lang objConnection.user = user objConnection.Password = currpass ''' Log on to system booReturn = objConnection.Logon(0, True) outFile.Write sysid & " " & client & ": " ''' Check if logon successful If booReturn <> True Then objConnection.LastError outFile.Write "Can't log on" Exit Sub Else outFile.Write "Login OK" End If ''' Prepare to call change password function funcControl.connection = objConnection Set CHPASS_FN = funcControl.Add("SUSR_USER_CHANGE_PASSWORD_RFC") Set expPassword = CHPASS_FN.Exports("PASSWORD") Set expNewPass = CHPASS_FN.Exports("NEW_PASSWORD") Set expFillRet = CHPASS_FN.Exports("USE_BAPI_RETURN") Set impReturn = CHPASS_FN.Imports("RETURN") expPassword.Value = currpass expNewPass.Value = newpass expFillRet.Value = "1" ''' Call change password function If CHPASS_FN.Call = True Then outFile.Write (", Called Function") Message = impReturn("MESSAGE") outFile.WriteLine " : " & Message Else outFile.Write (", Call to function failed") End If outFile.WriteLine vbNewLine End Sub