Setting Access Privileges for SAP System Directories on Windows

For security reasons, the SAP system and user data is stored in a special directory structure in the operating system. The SAP system and user data is protected with defined access authorizations.

The following tables show the permissions on share and file system level. These access privileges shown in the following table are automatically set during installation using SAP's installation tool, the software provisioning manager. For more information about how the SAP system directory structure is established in the Windows file system, see the installation guide for the respective SAP system in the Guide Finder for SAP NetWeaver and ABAP Platform.

Local-Based Installation (saploc and sapmnt Share)
SAP Directory or Files	Local User Groups	Permissions
\`<usr>`\`<sap>`	SAP_<SID>_LocalAdmin	Full Control
\`<usr>`\`<sap>`\`<trans>`	SAP_<SID>_LocalAdmin	Full Control
\`<usr>`\`<sap>`\`<SID>`\`<sys>`\`<global>`\`<security>`	SAP_<SID>_LocalAdmin	Full Control The folder security should only be accessible by SAP users and not by the administrators group. Remove the group if it exists, but don't add a `Deny` rule for the administrators group to the security folder.

Domain-Based Installation (saploc and sapmnt Share)
SAP Directory or Files	Domain User Group	Permissions
\`<usr>`\`<sap>`	SAP_<SID>_GlobalAdmin	Full Control
\`<usr>`\`<sap>`\`<trans>`	SAP_<SID>_GlobalAdmin	Full Control
\`<usr>`\`<sap>`\`<SID>`\`<sys>`\`<global>`\`<security>`	SAP_<SID>_GlobalAdmin	Full Control The folder security should only be accessible by SAP users and not by the administrators group. Remove the group if it exists, but don't add a `Deny` rule for the administrators group to the security folder.