--- description: Parameter login/fails_to_session_end & login/fails_to_user_lock are used to limit logon attempts title: login/fails_to_session_end – SAP RZ11 image: https://www.guru99.com/images/sap-rz11-limit-logon-attempts.png --- [Skip to content](#main) **⚑ Smart Summary** SAP RZ11 is the dynamic profile-parameter maintenance transaction used to limit failed logon attempts in SAP. Setting login/fails\_to\_session\_end and login/fails\_to\_user\_lock protects accounts by ending sessions and locking users after repeated incorrect passwords. - πŸ”‘ **Parameter Basics:** A parameter is a key-value setting that controls SAP behavior; dynamic parameters apply immediately, while static ones require a restart. - πŸ”Ž **View Parameters:** Execute T-code RZ11, enter the parameter name, and click Display to review the current value. - πŸ”’ **Session Limit:** The login/fails\_to\_session\_end parameter ends the logon attempt after a defined number of wrong passwords. - 🚫 **User Lock:** The login/fails\_to\_user\_lock parameter locks the account after repeated failures; the SAP default is 12, adjustable from 1 to 99. - βš–οΈ **Correct Ordering:** Keep fails\_to\_session\_end lower than fails\_to\_user\_lock so a session ends before the account locks. - πŸ›‘οΈ **Automatic Reset:** The failed-logon counter resets after a successful logon, and the lock expires at the end of the day. - πŸ€– **Monitoring:** Track lockouts through the Security Audit Log and AI-driven anomaly detection for stronger protection. Read More ![Limit Logon Attempts in SAP using RZ11](https://www.guru99.com/images/sap-rz11-limit-logon-attempts.png) Before we learn to limit logon attempts we need to know parameter – ## What is a parameter? **Parameter** is the set of keys and values to manage the SAP system. There are two types of parameters – 1. **Static: –** It needs a restart. It doesn’t effect to the system immediately once you set the value for it. 2. **Dynamic: –** It does not need restart. It effects to the system immediately once you set the value for it. ## How to view a parameter? **Step 1)** Execute T-code RZ11. [![SAP RZ11:View Parameter]()](https://www.guru99.com/images/sap/2013/05/051313_1227_1.png) **Step 2)** 1. Put parameter name β€œ**login/fails\_to\_session\_end”** in text-field. You can put any Parameter name. 2. Click Display [![SAP RZ11:View Parameter]()](https://www.guru99.com/images/sap/2013/05/051313_1227_2.png) **Step 3)** The screen below shows the current value set for the parameter by the admin [![SAP RZ11:View Parameter]()](https://www.guru99.com/images/sap/2013/05/051313_1227_3.png) In order to change a parameter, click the pencil icon and make desired changes ## Important Parameters to limit login attempts - **login/fails\_to\_session\_end**: This parameter specifies the number of times that a user can enter an incorrect password before the system ends the logon attempt. The parameter is to be set to a value lower than the value of parameter - **login/fails\_to\_user\_lock**: This parameter specifies the number of times that a user can enter an incorrect password before the system locks the user against further logon attempts. [SAP system](https://www.guru99.com/what-is-sap.html) default value is 12. You can set it to any value between 1 and 99 inclusive. ## How to Change a Parameter Value in RZ11 Viewing a parameter is only the first step. When you need to tighten logon security, you must edit the value. RZ11 changes a **dynamic** parameter instantly, but the change is lost after the next restart unless it is also written to the instance profile. 1. Execute **RZ11**, type the parameter name (for example *login/fails\_to\_user\_lock*), and click **Display**. 2. Click the **Change Value** (pencil) button on the parameter screen. 3. Enter the new value within the permitted range and save. The dynamic switch takes effect immediately for new logons. 4. To make the value permanent, maintain the same parameter in the instance profile using transaction **RZ10** and activate the profile. Because both parameters are dynamic, administrators can respond to a brute-force attempt in real time, then persist the value through RZ10 so it survives a system restart. Always test a new value in a non-production client first to confirm that legitimate users are not locked out unexpectedly. **Don't Miss:** - [What is Client? How to Create a New Client in SAP SCC4](https://www.guru99.com/create-new-client.html) - [How to Delete a Client in SAP SM50](https://www.guru99.com/how-to-delete-a-client.html) - [SAP TMS (Transport Management System) Tutorial](https://www.guru99.com/transport-management-system-tms.html) - [60 SAP Basis Interview Questions & Answers (2026 Update)](https://www.guru99.com/sap-basis-interview-questions.html) ## RZ10 vs RZ11: Which Transaction to Use Both transactions manage profile parameters, but they serve different purposes. RZ11 is best for viewing and quick dynamic changes, whereas RZ10 maintains the persistent instance and default profiles. | Criteria | RZ11 | RZ10 | | --- | --- | --- | | Purpose | Display and change single parameters | Maintain complete profiles | | Scope | One parameter at a time | All parameters in a profile | | Persistence | Dynamic, lost on restart | Permanent after activation | | Best for | Quick checks and hotfixes | Baseline security configuration | ## Best Practices to Limit Logon Attempts in SAP A well-tuned lockout policy stops password-guessing attacks without disrupting genuine users. Apply the following best practices: - **Order the parameters correctly:** Set login/fails\_to\_session\_end lower than login/fails\_to\_user\_lock. - **Use sensible limits:** A user-lock value of three to five balances security and usability. - **Persist critical values:** Save security parameters in the profile through RZ10 so they survive restarts. - **Enable auditing:** Log failed logons and lockouts in the Security Audit Log (SM19/SM20) for review. - **Combine with password rules:** Pair lockout limits with strong password restrictions for defense in depth. ## FAQs πŸ”’ What is the default value of login/fails\_to\_user\_lock? The SAP default is 12 failed attempts before the user is locked. You can set any value between 1 and 99. Most organizations lower it to three to five for tighter brute-force protection. πŸ•” When does a locked SAP user get unlocked automatically? An automatic lock from failed logons is released at the end of the current day. The failed-logon counter also resets after a successful logon. An administrator can unlock the user earlier through transaction SU01. πŸ” What is the difference between a dynamic and a static parameter? A dynamic parameter takes effect immediately when changed in RZ11, while a static parameter requires a system restart. Logon security parameters are dynamic, so administrators can enforce new limits without downtime. πŸ€– Can AI help monitor failed logon attempts in SAP? Yes. AI-driven security tools analyze the Security Audit Log to flag unusual logon patterns, repeated failures, and brute-force attempts in real time. They complement RZ11 limits by alerting administrators before accounts are compromised. 🧠 Does SAP use AI to recommend security parameter values? Increasingly, yes. Tools such as SAP Security Optimization and the [artificial intelligence](https://www.guru99.com/artificial-intelligence-tutorial.html) features in modern monitoring suites benchmark your parameters against best practices and suggest safer values for logon and password controls. #### Summarize this post with: ChatGPTPerplexityGrokGoogle AI **Stay Updated on AI** **Get Weekly AI Skills, Trends, Actionable Advice.** ##### Sign up for the newsletter Subscribe for Free You have successfully subscribed. Please check your inbox. ![AI-Newsletter]() Chosen by over **350,000+** professionals [Scroll to top](#wrapper) Γ— Search for: ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.guru99.com/#organization","name":"Guru99","sameAs":["https://www.facebook.com/Guru99Official","https://twitter.com/guru99com"],"logo":{"@type":"ImageObject","@id":"https://www.guru99.com/#logo","url":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","contentUrl":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","caption":"Guru99","inLanguage":"en-US"}},{"@type":"WebSite","@id":"https://www.guru99.com/#website","url":"https://www.guru99.com","name":"Guru99","publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://www.guru99.com/images/sap-rz11-limit-logon-attempts.png","url":"https://www.guru99.com/images/sap-rz11-limit-logon-attempts.png","width":"700","height":"250","caption":"SAP RZ11: Limit Logon Attempts","inLanguage":"en-US"},{"@type":"BreadcrumbList","@id":"https://www.guru99.com/how-to-limit-logon-attempts.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":"1","item":{"@id":"https://www.guru99.com","name":"Home"}},{"@type":"ListItem","position":"2","item":{"@id":"https://www.guru99.com/sap-basis","name":"SAP - Basis"}},{"@type":"ListItem","position":"3","item":{"@id":"https://www.guru99.com/how-to-limit-logon-attempts.html","name":"login/fails_to_session_end – SAP RZ11"}}]},{"@type":"WebPage","@id":"https://www.guru99.com/how-to-limit-logon-attempts.html#webpage","url":"https://www.guru99.com/how-to-limit-logon-attempts.html","name":"login/fails_to_session_end – SAP RZ11","dateModified":"2026-10-09T12:06:32+05:30","isPartOf":{"@id":"https://www.guru99.com/#website"},"primaryImageOfPage":{"@id":"https://www.guru99.com/images/sap-rz11-limit-logon-attempts.png"},"inLanguage":"en-US","breadcrumb":{"@id":"https://www.guru99.com/how-to-limit-logon-attempts.html#breadcrumb"}},{"@type":"Person","@id":"https://www.guru99.com/author/editorial","name":"Editorial Team","url":"https://www.guru99.com/author/editorial","image":{"@type":"ImageObject","@id":"https://www.guru99.com/images/favicon-new-logo.png","url":"https://www.guru99.com/images/favicon-new-logo.png","caption":"Editorial Team","inLanguage":"en-US"},"sameAs":["https://www.guru99.com/editorial-team"],"worksFor":{"@id":"https://www.guru99.com/#organization"}},{"articleSection":"SAP - Basis","headline":"login/fails_to_session_end – SAP RZ11","description":"Parameter login/fails_to_session_end & login/fails_to_user_lock are used to limit logon attempts","keywords":"sap-basis, sap","speakable":{"@type":"SpeakableSpecification","cssSelector":[".entry-title",".summary"]},"@type":"Article","author":{"@id":"https://www.guru99.com/author/editorial","name":"Editorial Team"},"dateModified":"2026-10-09T12:06:32+05:30","image":{"@id":"https://www.guru99.com/images/sap-rz11-limit-logon-attempts.png"},"copyrightYear":"2026","name":"login/fails_to_session_end – SAP RZ11","subjectOf":[{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is the default value of login/fails_to_user_lock?","acceptedAnswer":{"@type":"Answer","text":"The SAP default is 12 failed attempts before the user is locked. You can set any value between 1 and 99. Most organizations lower it to three to five for tighter brute-force protection."}},{"@type":"Question","name":"When does a locked SAP user get unlocked automatically?","acceptedAnswer":{"@type":"Answer","text":"An automatic lock from failed logons is released at the end of the current day. The failed-logon counter also resets after a successful logon. An administrator can unlock the user earlier through transaction SU01."}},{"@type":"Question","name":"What is the difference between a dynamic and a static parameter?","acceptedAnswer":{"@type":"Answer","text":"A dynamic parameter takes effect immediately when changed in RZ11, while a static parameter requires a system restart. Logon security parameters are dynamic, so administrators can enforce new limits without downtime."}},{"@type":"Question","name":"Can AI help monitor failed logon attempts in SAP?","acceptedAnswer":{"@type":"Answer","text":"Yes. AI-driven security tools analyze the Security Audit Log to flag unusual logon patterns, repeated failures, and brute-force attempts in real time. They complement RZ11 limits by alerting administrators before accounts are compromised."}},{"@type":"Question","name":"Does SAP use AI to recommend security parameter values?","acceptedAnswer":{"@type":"Answer","text":"Increasingly, yes. Tools such as SAP Security Optimization and the artificial intelligence features in modern monitoring suites benchmark your parameters against best practices and suggest safer values for logon and password controls."}}]}],"@id":"https://www.guru99.com/how-to-limit-logon-attempts.html#schema-1134607","isPartOf":{"@id":"https://www.guru99.com/how-to-limit-logon-attempts.html#webpage"},"publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US","mainEntityOfPage":{"@id":"https://www.guru99.com/how-to-limit-logon-attempts.html#webpage"}}]} ```