Changing TMSADM password is too complex, SAP security note 1414256

SAP security note 1414256, "Streamlining TMSADM Password Changes". Below are the symptom and SAP recommended solution.

Description

Symptom

This security note addresses the complexity involved in changing the password of the user TMSADM. Previously, the process required numerous manual steps, making it cumbersome for administrators.

Solution

Instead of relying on manual steps as described in Note 761637, this note introduces a report named TMS_UPDATE_PWD_OF_TMSADM that automates the password change process. The report performs the following actions:

• Creating Test Users and Destinations: Sets up necessary test environments across all systems.
• Validating Test Users and Destinations: Ensures that the test setup is correct before proceeding.
• Updating Passwords: Changes the TMSADM passwords uniformly across the landscape.

Execution steps:

• Run the Report: Execute TMS_UPDATE_PWD_OF_TMSADM in client 000 of the domain controller. Choose one of the available password options:
  • Enter a Custom Password: Ensure it meets compatibility and security requirements.
  • Set Standard Password: Uses the default password defined during the implementation of Note 761637.
  • Reset to Original Password: Reverts to the standard password used since Release 3.1I, useful for troubleshooting.
• Approve Logons: The system will request logons in client 000 of every system in the TMS domain.
• Monitor Execution: The report will display a log of all actions performed, which can be reviewed at any time.

Known limitations:

• The report does not support domain links.
• Systems must remain unlocked during the password change to prevent the TMSADM account from being locked across the landscape.

Troubleshooting: if systems are locked during the password change:

• Unlock all systems before executing the report.
• If locking occurs, change the password in the locked systems manually using the report or refer to Note 761637.

Reason and prerequisites

The complexity arises due to missing functions and specific security requirements. To implement the solution provided in this note (up to Release 6.40), certain prerequisites must be met:

• Import Support Packages or implement correction instructions in all systems within the relevant landscape.
• Ensure administration authorizations are granted to the executing user across all systems.
• Deactivate SNC protection before changing the TMSADM password. In systems with high Quality of Protection (QoP), reduce the QoP level to allow non-secure connections temporarily.