---
description: Tcode used for SM30, USR40. You can use the following system profile parameters to specify the minimum length of a password and the frequency with which users must change their password.
title: "SAP USR40: How to set Password Restrictions"
image: https://www.guru99.com/images/sap-usr40-password-rules.png
---

[Skip to content](#main)

**⚡ Smart Summary**

SAP USR40 is the table used to set password restrictions in SAP by blacklisting impermissible passwords. Combined with login profile parameters, it enforces minimum length, expiration, and prohibited patterns to strengthen account security across the system.

- 🔤 **Minimum Length:** The login/min\_password\_lng parameter sets the shortest allowed password length.
- ⏳ **Expiration:** The login/password\_expiration\_time parameter defines how many days before a password must change.
- 🚫 **Blacklist Table:** Table USR40, maintained with SM30, stores passwords that users are not allowed to choose.
- ✳️ **Wildcards:** Use ? for a single character and \* for any sequence to block whole password patterns.
- 🧩 **Pattern Examples:** 123\* blocks anything starting with 123, and \*123\* blocks anything containing 123.
- 🛡️ **Defense in Depth:** Pair USR40 blacklists with logon-attempt limits for stronger protection.
- 🤖 **Automation:** AI-based tools audit weak or reused passwords and recommend policy improvements.

Read More

![Set Password Restrictions in SAP using USR40](https://www.guru99.com/images/sap-usr40-password-rules.png)

Strong password rules are a first line of defense for any SAP system. This walkthrough explains how to set password restrictions using table USR40 and the related login profile parameters that control password length, expiration, and prohibited patterns.

## What is USR40 in SAP?

USR40 is the SAP table that stores **impermissible passwords**—the words and patterns that users are not allowed to set. It is a core part of SAP password policy, working alongside the **login/\*** profile parameters that govern password length and expiration. Security administrators maintain the table with transaction **SM30**.

By listing weak or predictable values such as a company name, “password”, or common number sequences, USR40 forces users to choose stronger credentials. Because entries support wildcards, a single row can block an entire family of passwords. Maintaining USR40 is a simple but effective step in hardening [SAP security](https://www.guru99.com/overview-of-sap-security.html) and meeting audit and compliance requirements.

## Specifying Impermissible Passwords

You can prevent users from choosing passwords that you do not want to allow. To prohibit the use of a password, enter it in table USR40. You can maintain table USR40 with Transaction SM30. In **USR40**, you can specify impermissible passwords generically if you want. There are two wildcard characters:

1. **?** stands for a single character
2. **\*** stands for a sequence of any combination characters of any length.

**123\*** in table USR40 prohibits any password that begins with the sequence “123.”

**\*123\*** prohibits any password that contains the sequence “123.”

**AB?** prohibits all passwords that begin with “AB” and have one additional character: “ABA”, “ABB”, “ABC” and so on.

## How to Set Password Restrictions in USR40

**To set restriction for password follow the below procedure:-**

**Step 1)** Execute T-code SM30.

[![Set Password Restrictions in SAP]()](https://www.guru99.com/images/sap/2013/05/051313_1219_1.png)

**Step 2)** Enter the table name USR40 in “Table/View” field.

[![Set Password Restrictions in SAP]()](https://www.guru99.com/images/sap/2013/05/051313_1219_2.png)

**Step 3)** Click Display button.

[![Set Password Restrictions in SAP]()](https://www.guru99.com/images/sap/2013/05/051313_1219_3.png)

**Step 4)** Enter password expression string.

[![Set Password Restrictions in SAP]()](https://www.guru99.com/images/sap/2013/05/051313_1219_4.png)

That’s it for password management!

**Don't Miss:**

- [How to Download & Install SAP GUI](https://www.guru99.com/guide-to-install-sap-gui-aka-frontend.html)
- [login/fails\_to\_session\_end – SAP RZ11](https://www.guru99.com/how-to-limit-logon-attempts.html "login/fails_to_session_end – SAP RZ11")
- [SAP RSBTCDEL2: How to Delete a Background Job](https://www.guru99.com/how-to-delete-a-background-job.html)
- [STMS Configuration in SAP](https://www.guru99.com/how-to-configure-tms.html)

## Key Password Profile Parameters in SAP

You can use the following system profile parameters to specify the minimum length of a password and the frequency with which users must change their password.

- **login/min\_password\_lng**: minimum password length.Default value: Three characters. You can set it to any value between 3 and 8.
- **login/password\_expiration\_time**: number of days after which a password expires To allow users to keep their passwords without limit, leave the value set to the default 0.

Modern SAP systems offer several more parameters that let you enforce complexity. Maintain these in the instance profile (RZ10) alongside the USR40 blacklist:

| Parameter | Purpose |
| --- | --- |
| login/min\_password\_lng | Minimum number of characters in a password |
| login/min\_password\_digits | Minimum number of digits required |
| login/min\_password\_letters | Minimum number of letters required |
| login/min\_password\_specials | Minimum number of special characters required |
| login/password\_expiration\_time | Days before a password must be changed |
| login/password\_history\_size | Number of previous passwords that cannot be reused |

## Best Practices for SAP Password Security

Combine table restrictions and profile parameters into a single, enforceable policy. The following practices keep passwords strong and compliant:

- **Blacklist predictable values:** Add company names, seasons, and common sequences to USR40 using wildcards.
- **Enforce complexity:** Require a mix of letters, digits, and special characters through the login parameters.
- **Rotate passwords:** Set a sensible expiration time so credentials do not remain valid indefinitely.
- **Prevent reuse:** Use login/password\_history\_size to stop users cycling back to old passwords.
- **Layer your defenses:** Combine password rules with [logon-attempt limits](https://www.guru99.com/how-to-limit-logon-attempts.html) to block brute-force attacks.

## FAQs

🔐 How can users be forced to change their password at first logon?

SAP automatically prompts users to change an administrator-assigned initial password at their first logon. You can also use the login/password\_expiration\_time parameter to force periodic changes, keeping credentials current and reducing the risk of compromised accounts.

🆚 What is the difference between login/min\_password\_lng and USR40?

login/min\_password\_lng is a profile parameter that enforces the minimum password length. USR40 is a table that blacklists specific or wildcard password patterns. Together they define how strong and how unique SAP passwords must be.

♻️ Do password restriction changes in USR40 require a system restart?

No. USR40 is a table maintained through SM30, so new blacklisted entries apply immediately. Most login profile parameters are dynamic as well, although some password parameters take full effect only at the next password change.

🤖 Can AI help enforce stronger password policies in SAP?

Yes. [Artificial intelligence](https://www.guru99.com/artificial-intelligence-tutorial.html)-driven identity tools analyze password strength, detect reused or breached credentials, and recommend parameter values. They complement USR40 blacklists by continuously auditing policy compliance across the SAP landscape.

🧠 Does AI help detect weak or compromised SAP passwords?

Yes. Machine-learning security tools compare stored passwords against breach databases and flag weak patterns. This lets administrators expand the USR40 blacklist and tighten login parameters before attackers exploit predictable credentials.

#### Summarize this post with:

ChatGPTPerplexityGrokGoogle AI

**Stay Updated on AI** **Get Weekly AI Skills, Trends, Actionable Advice.**

##### Sign up for the newsletter

Subscribe for Free

You have successfully subscribed.  
Please check your inbox.

![AI-Newsletter]() Chosen by over **350,000+** professionals

[Scroll to top](#wrapper)

×

Search for:

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.guru99.com/#organization","name":"Guru99","sameAs":["https://www.facebook.com/Guru99Official","https://twitter.com/guru99com"],"logo":{"@type":"ImageObject","@id":"https://www.guru99.com/#logo","url":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","contentUrl":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","caption":"Guru99","inLanguage":"en-US"}},{"@type":"WebSite","@id":"https://www.guru99.com/#website","url":"https://www.guru99.com","name":"Guru99","publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://www.guru99.com/images/sap-usr40-password-rules.png","url":"https://www.guru99.com/images/sap-usr40-password-rules.png","width":"700","height":"250","caption":"SAP USR40: Password Rules","inLanguage":"en-US"},{"@type":"BreadcrumbList","@id":"https://www.guru99.com/how-to-set-password-restrictions.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":"1","item":{"@id":"https://www.guru99.com","name":"Home"}},{"@type":"ListItem","position":"2","item":{"@id":"https://www.guru99.com/sap-basis","name":"SAP - Basis"}},{"@type":"ListItem","position":"3","item":{"@id":"https://www.guru99.com/how-to-set-password-restrictions.html","name":"SAP USR40: How to set Password Restrictions"}}]},{"@type":"WebPage","@id":"https://www.guru99.com/how-to-set-password-restrictions.html#webpage","url":"https://www.guru99.com/how-to-set-password-restrictions.html","name":"SAP USR40: How to set Password Restrictions","dateModified":"2026-10-09T12:06:36+05:30","isPartOf":{"@id":"https://www.guru99.com/#website"},"primaryImageOfPage":{"@id":"https://www.guru99.com/images/sap-usr40-password-rules.png"},"inLanguage":"en-US","breadcrumb":{"@id":"https://www.guru99.com/how-to-set-password-restrictions.html#breadcrumb"}},{"@type":"Person","@id":"https://www.guru99.com/author/editorial","name":"Editorial Team","url":"https://www.guru99.com/author/editorial","image":{"@type":"ImageObject","@id":"https://www.guru99.com/images/favicon-new-logo.png","url":"https://www.guru99.com/images/favicon-new-logo.png","caption":"Editorial Team","inLanguage":"en-US"},"sameAs":["https://www.guru99.com/editorial-team"],"worksFor":{"@id":"https://www.guru99.com/#organization"}},{"articleSection":"SAP - Basis","headline":"SAP USR40: How to set Password Restrictions","description":"Tcode used for SM30, USR40. You can use the following system profile parameters to specify the minimum length of a password and the frequency with which users must change their password.","keywords":"sap-basis, sap","speakable":{"@type":"SpeakableSpecification","cssSelector":[".entry-title",".summary"]},"@type":"Article","author":{"@id":"https://www.guru99.com/author/editorial","name":"Editorial Team"},"dateModified":"2026-10-09T12:06:36+05:30","image":{"@id":"https://www.guru99.com/images/sap-usr40-password-rules.png"},"copyrightYear":"2026","name":"SAP USR40: How to set Password Restrictions","subjectOf":[{"@type":"HowTo","name":"How to set Password Restrictions","description":"To set restriction for password follow the below procedure:-","step":[{"@type":"HowToStep","text":"Execute T-code","name":"SM30.","image":"https://www.guru99.com/images/sap/2013/05/051413_0752_1.png","url":"https://www.guru99.com/how-to-set-password-restrictions.html"},{"@type":"HowToStep","text":"Enter the table name","name":"USR40 in 'Table/View' field.","image":"https://www.guru99.com/images/sap/2013/05/051313_1219_2.png","url":"https://www.guru99.com/how-to-set-password-restrictions.html"},{"@type":"HowToStep","text":"Enter password expression string.","name":"That\u2019s it for password management!","image":"https://www.guru99.com/images/sap/2013/05/051313_1219_4.png","url":"https://www.guru99.com/how-to-set-password-restrictions.html"}]},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How can users be forced to change their password at first logon?","acceptedAnswer":{"@type":"Answer","text":"SAP automatically prompts users to change an administrator-assigned initial password at their first logon. You can also use the login/password_expiration_time parameter to force periodic changes, keeping credentials current and reducing the risk of compromised accounts."}},{"@type":"Question","name":"What is the difference between login/min_password_lng and USR40?","acceptedAnswer":{"@type":"Answer","text":"login/min_password_lng is a profile parameter that enforces the minimum password length. USR40 is a table that blacklists specific or wildcard password patterns. Together they define how strong and how unique SAP passwords must be."}},{"@type":"Question","name":"Do password restriction changes in USR40 require a system restart?","acceptedAnswer":{"@type":"Answer","text":"No. USR40 is a table maintained through SM30, so new blacklisted entries apply immediately. Most login profile parameters are dynamic as well, although some password parameters take full effect only at the next password change."}},{"@type":"Question","name":"Can AI help enforce stronger password policies in SAP?","acceptedAnswer":{"@type":"Answer","text":"Yes. Artificial intelligence-driven identity tools analyze password strength, detect reused or breached credentials, and recommend parameter values. They complement USR40 blacklists by continuously auditing policy compliance across the SAP landscape."}},{"@type":"Question","name":"Does AI help detect weak or compromised SAP passwords?","acceptedAnswer":{"@type":"Answer","text":"Yes. Machine-learning security tools compare stored passwords against breach databases and flag weak patterns. This lets administrators expand the USR40 blacklist and tighten login parameters before attackers exploit predictable credentials."}}]}],"@id":"https://www.guru99.com/how-to-set-password-restrictions.html#schema-551647","isPartOf":{"@id":"https://www.guru99.com/how-to-set-password-restrictions.html#webpage"},"publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US","mainEntityOfPage":{"@id":"https://www.guru99.com/how-to-set-password-restrictions.html#webpage"}}]}
```