Handling the generated user TMSADM, SAP security note 1488406

SAP security note 1488406, "Handling the generated user TMSADM". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This note addresses the prevention of misuse of the user account TMSADM.

Solution

• Implement the New Standard Password (Release 4.6C and later) – Utilize the new standard password introduced in Release 4.6C to ensure TMSADM complies with complex password rules. The password length remains 8 characters for compatibility reasons. Refer to Note 761637 for more details.
• Define a Custom TMSADM Password – Avoid linking systems of different releases permanently via TMS to prevent issues with custom TMSADM passwords; place systems with the same release in separate TMS domains (see Note 1023437). Define a unique password for the TMSADM account across your TMS landscape (see Note 761637). Use the available help tool for large landscapes without domain links to streamline the password change process (see Note 1414256), or use external systems for occasional transport request exchanges between domains.

If you have systems running a release lower than 4.6C, segregate them into separate TMS domains and lock the TMSADM account. For further information, refer to Note 1486759.

Reason and prerequisites

The user account TMSADM is essential for the Transport Management System (TMS) as it facilitates the communication infrastructure. During the configuration of the TMS in client 000 of each involved system, this account is created with a fixed password, allowing read access to TMS-provided information, including transport directory contents.

References

• Note 1515926 – Update #1 to Security Note 1414256
• Note 1504652 – Consulting: Secure Configuration of Application Server ABAP
• Note 1414256 – Changing TMSADM password is too complex
• Note 1023437 – ABAP syst: Downwardly incompatible passwords (since NW2004s)
• Note 761637 – Logon restrictions prevent TMSADM logon

Affected components

• SAP_APPL: 31H to 31I, 40A to 40B, 45A to 45B
• SAP_BASIS: 46A to 46D, 610 to 640, 700 to 702+, 710 to 730+