Enablement and security

GUI Scripting is powerful, and SAP ships it switched off on the server. Before any automation can run, Basis and security must agree where scripting is allowed, for whom and in which mode. For Contoso, that conversation was between Priya, Sam (Basis lead) and the security team, and its outcome is documented as part of the test environment design.

Server side: the profile parameters

SAP's security guide states that GUI Scripting is disabled by default on any SAP system. The administrator enables it with the profile parameter sapgui/user_scripting set to TRUE. It can be set dynamically in transaction RZ11, where the value must be entered in uppercase and takes effect at the next logon; a change made only in RZ11 is lost at restart, so a permanent setting belongs in the instance profile. With several application servers, the "switch on all servers" option matters, or the setting applies only to the server you are on. Further parameters refine the main switch:

RZ11 switches scripting on until the next restart; only the instance profile makes it permanent.

The Sign-Off Table · thesignofftable.com/academy/sap-tau-201

Parameter	Effect when TRUE
sapgui/user_scripting	Enables GUI Scripting on the application server (the main switch; FALSE by default)
sapgui/user_scripting_per_user	Scripting remains available after logon only for users with authorization object S_SCR, activity 16 (Execute)
sapgui/user_scripting_set_readonly	Only read access to properties and read-only functions; no call that changes the data sent to the server
sapgui/user_scripting_disable_recording	Existing scripts can run, but new recordings and scripting events are disabled
sapgui/user_scripting_force_notification	Users are asked for confirmation whenever a script tries to use a connection to this system, regardless of client settings
sapgui/nwbc_scripting	Read-only scripting for side panels in SAP Business Client without granting full scripting

Server-side scripting parameters as described in SAP's GUI Scripting Security Guide. The refining parameters take effect only when the main switch is on.

Whether a script can run, and how much it can do, depends on the main switch, the per-user check and the read-only setting.

The Sign-Off Table · thesignofftable.com/academy/sap-tau-201

The per-user and read-only parameters can also be combined. SAP's guide describes a client registry switch that, when set, gives users with S_SCR full scripting and everyone else read-only scripting, which is useful when some users need full automation and others only need read-only scripting for accessibility or side panels. Check the guide and SAP Note 2565390 for your SAP GUI patch level.

Client side: installation and user settings

On the PC, scripting must be installed (it is included in the standard SAP GUI installation, but administrators can build installation packages without it) and enabled. An administrator can disable it for a machine through a registry value under the local machine branch. Users can turn it off for themselves and choose whether to be notified when a script attaches to SAP GUI or opens a connection; these settings are available in the SAP GUI Options dialog. SAP recommends keeping the notifications unless there is a real need, such as screen reader support.

Server profilesapgui/user_scripting on the application servers of the target system

Server refinementsPer-user (S_SCR), read-only, no recording, forced notification

User authorizationS_SCR activity 16 in the test user's role, when per-user is active

Client installationScripting component installed with SAP GUI for Windows

Client settingsScripting enabled; notifications on attach and on connection

Every layer must allow scripting before an automated test can run.

The Sign-Off Table · thesignofftable.com/academy/sap-tau-201

Why security teams care

Speed and volume. SAP's guide notes that a bad script can generate more bad data than a user before anyone notices.
Data export. A script can read every cell of a table or ALV grid that is displayed, effectively downloading data even where list download is restricted. SAP suggests Read Access Logging where data access must be checked.
Unattended use. Notifications exist so that scripts do not run without the user's knowledge.
Credentials. Passwords are never recorded, and SAP strongly discourages writing them into scripts; use single sign-on or SNC-enabled connections for automated logon.
Performance. Scripts run faster than people and can add load to the system.

Restricted per userTest systems such as CMQ: enable with per-user and grant S_SCR only to test and automation users

Exception onlyProduction: disabled or read-only; any full scripting needs a documented, time-limited exception

Open within limitsSandbox and training systems: enable broadly, keep notifications on

Read-onlySystems needing accessibility or side panels only: read-only mode or the side-panel parameter

A common way to decide scripting settings per system. Agree the actual policy with Basis and security.

The Sign-Off Table · thesignofftable.com/academy/sap-tau-201

What would you do?

During hypercare, a key user asks Sam to enable GUI Scripting in production CMP so a recorded macro can mass-update 400 customer records. What should Sam do?

What would you do?

Contoso's desktop team plans to roll out SAP GUI for Windows 8.10 to all testers in the week before a feature pack stack regression. Ravi asks Priya whether that matters for the GUI automation. What should she answer?

Hands-on lab · ACCELQ

Prepare SAP GUI for ACCELQ (for learners with SAP GUI access)

This lab is for learners with SAP GUI access. You'll check this lesson's enablement layers, then let ACCELQ open an SAP session through the Local Agent.

Practice on Your company's SAP test system in SAP GUI for Windows, with scripting enabled by Basis. For learners with SAP GUI access only; never production.

If you haven't set up ACCELQ yet, do the setup lab first.
Confirm with Basis that sapgui/user_scripting is TRUE on the test system. ACCELQ's article also expects the disable_recording, force_notification and set_readonly parameters to be FALSE; Basis decides.
In the SAP Logon options, go to Accessibility & Scripting > Scripting and tick Enable scripting. ACCELQ asks for both notification boxes to be unticked so unattended runs don't hang. SAP recommends keeping them, so untick them only on a dedicated test machine.
Install the Local Agent on the same Windows machine as SAP GUI (Resources > Local Agents > Download Agent) and note the path to saplogon.exe.
SAP GUI automation also needs the ACCELQ RPA server, provided by ACCELQ, on that machine. Ask ACCELQ support for it during your trial.
In Resources > Global Properties, store your SAP Logon connection name and test user. If your connection supports single sign-on, use it so no password is stored at all; otherwise make the password an encrypted-text input fed by a Run Property, asked for masked at run time (check the login command accepts encrypted values). Never share the login.
Create a Context named SAP Session and an Action in it. In the Logic Editor, add Initialize SAP Logon Application, then Log in to SAP Session (standard or SSO, by connection name), then Execute transaction code in current SAP session with a display transaction your test user may run.
Add the Action to a Scenario and Run it on your Local Agent. If it stalls at logon, recheck the notification settings and the RPA server.

Done when The Test Report shows a green run that logged on and opened the transaction. Keep its link with a note of the scripting settings Basis confirmed for the test system.

Learn more in ACCELQ’s docs: Enabling SAP GUI Scripting for Automation · SAP GUI Automation with ACCELQ · How to encrypt sensitive information such as passwords in Test Logic and Reports

Start the free ACCELQ trial Matt Angerer, who runs The Sign-Off Table, works at ACCELQ. Disclosure

Key points

GUI Scripting is off by default; sapgui/user_scripting enables it per application server.
Refine with per-user (S_SCR activity 16), read-only, no-recording and forced-notification parameters.
Clients must have scripting installed and enabled; notifications protect users.
Agree a per-system policy with Basis and security; production usually stays off or read-only.

Server side: the profile parameters

Client side: installation and user settings

Why security teams care

Lesson check