Knowledge base / Data and connections
Usage data (ST03N)
A finding says a user can do two conflicting things. Usage data shows whether they ran the transactions on each side in the period. Findings where t-codes on both sides were run are marked Exercised and should be reviewed first.
How to export
- Run ST03N and switch to Expert mode.
- Choose Workload, the period (one month at a time works well), then User profile.
- Open the transaction profile per user and export to spreadsheet.
- Repeat for each month you want to cover. ClearDuty sums dialog steps per user and transaction.
The file needs UNAME, TCODE and optionally STEPS. STAD exports work as well.
What the labels mean
| Exercised | T-codes on both sides of the risk were run in the period. |
| Partly used | T-codes on only one side were run. The unused side is often the easiest to remove. |
| Not used | Neither side was run. Usually access that can simply go. |
What usage does and does not show. ST03N records that a user ran a transaction, not what they did with it. A user can run a t-code in display mode, for a different company code or object, or without completing the business activity the risk describes. So Exercised is evidence of activity to prioritise review — it does not establish that both conflicting activities took place, and it does not establish that a control failed. To confirm, look at the business documents and change logs for the period (for example vendor master changes in CDHDR/CDPOS and the payments posted by the same user).
Usage periods should cover at least one quarter-end or year-end close if the roles include closing activities, otherwise rarely used but legitimate access looks unused.
Still stuck? Ask us — we answer within one working day.