If we can reach the SAP system from database via SQLPLUS tool then we can lock or unlock any SAP users without the SAPGUI

Let’s look a little bit closer with some examples ;

First of all we need to know UFLAG variable ;

0      User status is UNLOCK , can logon to SAP system

32    User status is LOCK with GLOBAL ,  from Administrator , cannot logon to SAP system

64    User status is LOCK with LOCAL ,  from Administrator , cannot logon to SAP system

128   User status is LOCK , reason is wrong password , cannot logon to SAP system

Let’s check DDIC user status ;

SQL> select BNAME, MANDT, UFLAG from SAPSR3.USR02 where BNAME=’DDIC’; 

You can see the value ; UFLAG is 0 , so it means that user DDIC status is : UNLOCK

Now we are going to change DDIC’s UFLAG value to 64

SQL> update SAPSR3.USR02 set UFLAG=64 where BNAME=’DDIC’; 

SQL> commit;

P.S : Don’t forget to run “Commit” command after every update operation.

Now DDIC UFLAG value is 64 so this user cannot logon to SAP system anymore..

let’s change UFLAG value to 0 again to open DDIC user

SQL> update SAPSR3.USR02 set UFLAG=0 where BNAME=’DDIC’; 

SQL> commit;

Also we can do these kind of operations to MASS USERS

Select the users which we don’t want to LOCK (example: DDIC , SAP* ve FATIHYUKSEL)  and LOCK  all other DIALOG users with  (USTYP=A) UFLAG=32

SQL>update SAPSR3.USR02 set UFLAG=’32′ where BNAME not in 

(‘DDIC’,’SAP*’,’FATIHYUKSEL’) AND UFLAG=’0′ AND USTYP=’A’;

SQL>commit;

Except these three users, all other users are in LOCK status with UFLAG=32 value

To get back this operation just we need to run following syntax ;

SQL>update SAPSR3.USR02 set UFLAG=’0′ where BNAME not in 

(‘DDIC’,’SAP*’,’FATIHYUKSEL’) AND UFLAG=’32′ AND USTYP=’A’;

SQL>commit;

or simply

SQL>update SAPSR3.USR02 set UFLAG=’0′ where UFLAG=’32′;