Protecting Special Users 
SAP NetWeaver AS ABAP creates the standard users SAP*, DDIC, EARLYWATCH, TMSADM, and SAPCPIC during the installation process in the clients as shown in the following table.
User |
Description |
Client |
Default Password |
|---|---|---|---|
SAP* |
SAP NetWeaver AS system super user |
000, 001, all new clients |
Master password set during installation. Hard-coded password if SAP* does not exist in the client: PASS. |
DDIC |
ABAP dictionary and software logistics super user |
000, 001 |
Master password set during installation. |
EARLYWATCH |
Dialog user for the Early Watch service in client 066 |
066 |
Master password set during installation. |
SAPCPIC |
User for remote connections to legacy SAP systems (4.5) |
000, 001, all new clients |
ADMIN |
TMSADM |
User for transport management system (TMS) |
000 |
Master password set during installation. |
Recommendation
We recommend that you regularly review the following criteria for protecting standard users:
Maintain an overview of the clients that you have and make sure that no unknown clients exist.
Make sure that SAP* exists and has been deactivated in all clients.
Make sure that the default passwords for SAP*, DDIC, and EARLYWATCH have been changed.
Make sure that these users belong to the group SUPER in all clients.
Lock the users SAP*, DDIC, and EARLYWATCH. Unlock them only when necessary.
Delete SAPCPIC if you do not need it. At least make sure that you have changed the default password for SAPCPIC.
For more information, see Authorizations in Version Management.
Change the default password of TMSADM.
for more information, see Changing the Password of User TMSADM.
To find out which clients you have in your system, use report RSAUDIT_SYSTEM_STATUS using transaction SA38 or start Display View “Clients”: Overview (transaction SCC4).
To make sure that the user SAP* has been created in all clients and that the standard passwords have been changed for SAP*, DDIC, SAPCPIC, TMSADM, and EARLYWATCH, use the report RSUSR003.