Disabling all users

Madav Karna

Active Member
Hi,

During month end, our JDE team wanted to disable all the users except a selected few and the other system user-ids, so as to run month end process.
The plan was to run a update sql on F98OWSEC to disable all the users excluding the selected few and the system user-ids.
After the month-end is over, run the sql to enable the ids.

1) Is this an safe way to proceed, wanted to ensure that we don't end up messing the JDE system
2) Where can i get the list of JDE system user-ids, this is to validate the system users that are going to be placed in the sql.

Any help on this would be really appreciated :)

Thanks,
Karna
 
Hi Karna

I assume you have a different module of JDE e.g finance/HR etc, It is not good way to treat users to disable their JDE account. Also not a good practice to play with JDE with SQL statements as well

You may notify users not to login until month end finishes and monitor users through Audit/server manager.


Thanks
 
@Adeel: Thanks for your time and help :)
The Server Manager user notification was suggested, but our onsite folks wanted a plan B, where we can achieve this without Server Manager.
Any other way we can achieve this? And also where can i get the list of system users in JDE?.

Thanks,
Karna
 
@Adeel: Thanks for your time and help :)
The Server Manager user notification was suggested, but our onsite folks wanted a plan B, where we can achieve this without Server Manager.
Any other way we can achieve this? And also where can i get the list of system users in JDE?.

Thanks,
Karna


Other way to secure within JDE using data level security like UDC as I don't know what exactly required in your case and how many users and type of user we are talking
For the system users you can do SQL for the user don't have employee id which tells you type of users. still don't know how your setup done but this just my guess.

Thanks
AD
 
From an audit standpoint, performing repeated SQL's for something that is a business process that should be clearly communicated and followed by the users is not advisable.
 
The big question is why your team thinks its necessary to kick off all the users for running month end processing.
This isn't the 1980's anymore.
 
I agree with the others that this seems to be excessive. You don't state your JDE version or architecture but you are discussing Server Manager, so I am going to assume web architecture. You could setup a JVM specific to the financial users. During month end, just bring down all the other jvms which locks everyone out of the system.
 
You could setup a JVM specific to the financial users. During month end.[/QUOTE]

Jmart
Can you please shed some light how to do specific users for specific JVM? Or anybody else know

Thanks
 
There are a number of ways to achieve this.

1. create a "month end" Production environment - identical to JPD9x - just with a different name. Assign those "month end" users to a role that has access to the "month end" environment. Then, when you need to ensure month end is closed to usual users - rename the PD and JPD environment names in the Environment Master (I've been known to just add an "X" to the end of the environment name) - that way only the "month end" environment will work. Rename back when you need to reverse. The issue with this solution is that Scheduled jobs would be affected.
2. Create a "month end" production Weblogic Server. Only provide the URL to the "month end" users that need it. Disable access to the regular production weblogic servers. The issue here is that a non-month-end user could theoretically still log in.
3. Back-up the F98OWSEC (copy it to a database table using "Create Table" or "CPYF"). Disable all users that do not need access during month end. Then Restore the F98OWSEC once month end is over. Don't forget to refresh caches everywhere (preferably by stopping/starting services)
4. If you are publishing your Production Access through Citrix (publishing IE using Citrix) - then disable access to the icon through Citrix except for the select users. This is the safest method since it is exactly what Citrix is designed to do. But not everyone uses citrix to get access to JDE through IE.

If you're not using Citrix, I'd probably consider number (3). But listen to all the warnings...!
 
Hello Ad,

The simplest way to do this is with URLs. There are two basic/typical ways a JDE architecture is setup:
- load balanced - everyone connects using a "generic" URL which hits a load balancer and assigns the request to the next available JVM
- specific JVM - each user is given a link to a specific JDE JVM so they are always logged into that one JVM

In the case of the load balancer, there are a couple options:
- prevent connections to the load balancer entirely effectively locking everyone out of JDE. Give the financial users a "month end" URL that points to a specific JVM and does not go through the load balancer
- leave the load balancer up, but stop each individual JVM. Create a financial JVM that is not listed in the load balancer and, again, give the financial users a month end URL. Users will connect to the load balancer, but no servers will be available.

In the case of specific URLs the solution is to have the financial users always on their own JVM and you simply stop all the other JVMs during month end.

Jer
 
Thanks Both

I was expecting it would simply add finance role to specific JVM/instance in Server Manager regardless load balance or horizontal cluster and you can stop/start other JVM from server manager when you need it.

Thanks
AD
 
There should be absolutely no reason to prevent users from signing on while working month end. Look at all the productivity lost!

Here is what we've done to allow everyone to keep going:

Setup an alternate Production environment that points to the exact same objects except for the F0010. A one time copy of the F0010 is made and this alternate production environment maps to this copy. For those that do not know the F0010, it is the table that determines what period or month that allows GL transactions (as long as PBCO is not turned on and never should be). Only the month-end users can sign onto this alternate Production environment. The super user that is in charge of changing the period for the F0010 can then move the period in the real production environment while staying a month behind in the alternate environment.

Any CNC person should be able to set this up. I'm not a CNC person but I've been involved in setting this up at multiple clients even going back to JDE World where a simple change to the library list did the same thing.
 
In Madav Karna's defense, some companies, for what ever reason, want to be sure no activity is going on during closing.
Some 3rd party E1 tools are available to disable / enable multiple users at one time.
Dave
 
In Madav Karna's defense, some companies, for what ever reason, want to be sure no activity is going on during closing.
Some 3rd party E1 tools are available to disable / enable multiple users at one time.
Dave
Yes we told our clients about this, but they were so specific on no users being online in JDE at month-end.
 
Back
Top