Risk
Known accounts, default passwords and broad profiles can enable system takeover.
ABAPHANA
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Critical | SAP* | Exists and is locked in every client SUPER group, changed password, no profiles; audit all events, including EUP. |
| ABAP Critical | login/no_automatic_user_sapstar | 1 Protects against the automatic SAP* user. |
| ABAP Critical | DDIC | Changed password; SUPER group Controls use of the standard account. |
| ABAP Critical | SAPCPIC | Remove if unnecessary; otherwise change the password and assign SUPER Restricts the technical account. |
| ABAP Critical | TMSADM | Client 000 only; SUPER; profile S_A.TMSADM Change the default password through the appropriate TMS process. |
| ABAP Critical | EARLYWATCH | Absent from all clients Retires the standard account. |
| ABAP Standard | Standard Solution Manager accounts | Default passwords changed Include SMD_RFC, SAPSUPPORT and SOLMAN_ADMIN, among others. |
| HANA Standard | SYSTEM | Deactivate after establishing administrator access Do not use a restricted validity period as a substitute for deactivation. |
How to verify
- Review accounts in every client, including 000.
- Confirm locks, profiles, groups and password handling.
- Provide controlled emergency access.
- Verify logging of critical account activity.