How do I enable SAP GUI scripting?
To enable SAP GUI scripting, switch it on in two places. Basis sets sapgui/user_scripting to TRUE in RZ11 and in the instance profile, which keeps it after a restart. On each PC, tick Enable scripting in SAP GUI Options under Accessibility & Scripting. PostNow.ai needs both for Record, recorded-template runs, Debug, Call Transaction and SAP GUI test steps.
- Both switches, every time. The server parameter overrides the PC setting: with
FALSEon the server, no script runs, whatever SAP Logon says. - RZ11 alone is temporary. SAP drops a value set in RZ11 at the next restart, so the profile entry is what keeps scripting on.
- It can be limited.
sapgui/user_scripting_per_userrestricts scripting to users with authorization objectS_SCR.
This page is for the Basis administrator who gets the request, and for the SAP user or PostNow.ai designer who sees "scripting is switched off". It covers the server switch, the SAP Logon switch, the related parameters, the security questions, and a troubleshooting table. If scripting must stay off, the SAP GUI scripting alternative page covers the routes that post without driving screens.
Why PostNow.ai needs SAP GUI scripting
PostNow.ai needs SAP GUI scripting for every action that works in an SAP GUI window: it attaches to SAP GUI through SAP's scripting interface to log on, start a recording, start PostNow.ai's replay report (which posts with CALL TRANSACTION inside SAP) and open transactions. BAPI and API templates post over RFC and HTTP and open no SAP GUI window.
| PostNow.ai action | Needs SAP GUI scripting | How it reaches SAP |
|---|---|---|
| Record (a designer records a transaction for a recording template) | Yes | Opens a session in SAP GUI on the designer's PC and starts the SHDB recording through PostNow.ai's ZPOSTNOW_* recording report |
| Run and Simulate of a recorded template | Yes | Starts PostNow.ai's replay report in an SAP GUI session on the user's PC; the report replays the recording with CALL TRANSACTION inside SAP |
| Debug of a recorded template | Yes | Replays the recording in the user's SAP GUI, showing every screen or only the screens with errors |
| Call Transaction and opening a transaction from a query result | Yes | Opens the transaction in SAP GUI; for ME23N, VA03, MM03, FB03, XK03 and XD03 the document or master record number is filled in |
| SAP Testing: recording and playing SAP GUI test steps | Yes | Records with SAP GUI's own script recorder and replays in a new SAP GUI window of the tester's logon |
| BAPI templates: Simulate, Run, Retry Failed | No | Calls the BAPI over RFC; Simulate ends with BAPI_TRANSACTION_ROLLBACK |
| API templates: OData V2, OData V4, SOAP | No | Calls SAP's published API over HTTP |
| Reports and Mass Change downloads | No | Reads SAP tables over RFC; Mass Change posts the changed rows through its template's own route |
| Validate | No | Checks the sheet offline in Excel: required fields, type, length, characters, dates, decimals, allowed values |
When PostNow.ai opens SAP GUI and a switch is off, it says which one: "SAP GUI scripting is switched off on this computer" for the SAP Logon option, or "SAP system <SID> does not allow SAP GUI scripting", with your system ID, the parameter and RZ11, for the server.
PostNow.ai logs in to SAP GUI only on the user's own computer, with the user's own stored login, when the user starts the action: Record, Run, Debug or Call Transaction. Never on a server, never unattended, never with someone else's login. The stored login is encrypted for that Windows user on that PC, and every SAP authorization check runs as it does for the user at the keyboard.
So enable scripting on the SAP system, and in SAP Logon on the PCs of designers who record, of users who run recorded templates or use Call Transaction, and of testers with SAP GUI steps. A team that posts only through BAPI and API templates works without an SAP GUI session.
SAP GUI scripting is switched on in two places
SAP GUI scripting runs only when the SAP system allows it and the SAP GUI on the PC allows it, and PostNow.ai names the one that is off when it opens SAP GUI. By default the server switch is off on every SAP system, while the PC switch is on wherever the scripting component is installed and IT has not turned it off.
| Where | Setting | Who changes it | When it takes effect |
|---|---|---|---|
| SAP application server | Profile parameter sapgui/user_scripting = TRUE | Basis, in RZ11 (until the next restart) and in the instance profile (permanent) | At the user's next logon to that server |
| PC, per user | SAP GUI Options › Accessibility & Scripting › Scripting › Enable scripting (registry value UserScripting under HKEY_CURRENT_USER) | The user, unless IT has locked it | After SAP Logon is restarted |
| PC, per machine | Registry value UserScripting = 0 under HKEY_LOCAL_MACHINE, or a SAP GUI installation package without scripting | Desktop IT | Users cannot override it |
The server parameter overrides the client setting, so it is the one to ask for first (SAP Help). The two switches belong to two teams, which is why the request often takes longer than the change itself.
Enable it on the server: sapgui/user_scripting in RZ11
For PostNow.ai and any other SAP GUI script, Basis enables scripting on the server by setting sapgui/user_scripting to TRUE in transaction RZ11, then making the same value permanent in the instance profile. SAP documents the RZ11 steps on the SAP Help Portal.
- Open RZ11. Enter
sapgui/user_scriptingand choose Display. If RZ11 cannot find the parameter, the system's support package level is too low for it. - Change the value. Choose Change value and enter
TRUEin capitals; SAP reads any other spelling asFALSE. - Switch on all servers. On a system with several application servers and load balancing, tick Switch on all servers. Without it, the value changes only on the server you are logged on to.
- Save, then log off and on. The current value shows
TRUE. No restart is needed, but sessions that were already open keep the old setting. - Make it permanent. Add
sapgui/user_scripting = TRUEto the instance profile in RZ10. SAP states that a value set in RZ11 "will be lost when the system is restarted".
Steps 1 to 4 come from SAP's SAP GUI Scripting Security Guide, which also points to SAP Note 480149. A common pattern is RZ11 in a test client to prove the use case, then the profile change through the normal Basis change process.
Enable it in SAP Logon on the PC
On the PC, PostNow.ai uses the same SAP GUI option every script uses: Enable scripting, under SAP GUI Options › Accessibility & Scripting › Scripting. The Options dialog opens from SAP Logon, from a running SAP GUI session or from the Windows Control Panel.
- Open SAP GUI Options. In SAP Logon, open the menu in the top-left corner and choose Options. Menu labels move a little between SAP GUI releases; the Options dialog itself is the same.
- Go to Accessibility & Scripting › Scripting. Tick Enable scripting.
- Decide on the two notifications. "Notify when a script attaches to SAP GUI" and "Notify when a script opens a connection" are on by default. PostNow.ai's own setup help asks for both to be cleared, so an attach popup does not hold a recording or a replay; follow your security policy here.
- Restart SAP Logon. Close every SAP GUI window and SAP Logon, then start SAP Logon again.
If Enable scripting is greyed out, IT has set it centrally, and only IT can change it. The values behind the checkboxes are UserScripting, WarnOnAttach and WarnOnConnection under HKEY_CURRENT_USER\SOFTWARE\SAP\SAPGUI Front\SAP Frontend Server\Security, where 1 is the default for all three; IT can roll the same values out to every PC by policy.
Check that SAP GUI scripting works
PostNow.ai names the switch that is off when it opens SAP GUI for you. Without PostNow.ai, three checks tell you which side is blocking.
- RZ11 on each application server. Display
sapgui/user_scriptingand read the Current value. A value that differs between servers explains a script that works only sometimes. - The scripting icon in SAP GUI. SAP GUI shows a scripting icon: in the status bar in older themes, and in the system information area of the header in Belize and newer themes. It shows while a script runs, and its tooltip says when scripting is disabled.
- A one-line call. From Excel VBA,
GetObject("SAPGUI").GetScriptingEnginereturns the engine when the PC allows scripting. A connection to a system withFALSEon the server reports itself as disabled by the server, and a script cannot work with its sessions.
The most common "it worked yesterday" case is a restart: a value set only in RZ11 is gone, and the instance profile never had the entry.
The related parameters your Basis team will ask about
For PostNow.ai, the parameter that matters most after sapgui/user_scripting is sapgui/user_scripting_per_user, because it lets Basis enable scripting for the people who record and run, and nobody else. The others narrow what a script may do; they take effect only once sapgui/user_scripting is TRUE.
| Profile parameter | What TRUE does | What it means for PostNow.ai |
|---|---|---|
sapgui/user_scripting | Allows scripting on the application server. Off by default; overrides the PC setting. | Required on every server the designers, operators and testers log on to. |
sapgui/user_scripting_per_user | Scripting stays available on the logon screen for everyone; after logon, only for users with authorization object S_SCR, activity 16 (Execute). Default FALSE (SAP Note 983990). | Give S_SCR to the users who record, run recorded templates, use Call Transaction or run SAP GUI test steps. |
sapgui/user_scripting_set_readonly | Scripts may only read: no call that changes what is sent to the server, even without a database update. | PostNow.ai enters values in SAP GUI to log on, record and replay, so those users need full scripting, for example through per_user. |
sapgui/user_scripting_disable_recording | Switches off scripting events: existing scripts still run, new scripts cannot be recorded. | SAP Testing records SAP GUI test steps with SAP GUI's own recorder, so record those steps on a system where this is FALSE. |
sapgui/user_scripting_force_notification | Always shows the notification popup, whatever the PC's notification boxes say. | Users answer the popup each time PostNow.ai attaches to SAP GUI. |
sapgui/nwbc_scripting | Same as user_scripting plus set_readonly; meant for SAP Business Client side panels. | Read-only scripting, as above. |
Up to SAP GUI 7.40 patch 16 and 7.50 patch 3, set_readonly overrode per_user for everyone. Later patches add a switch: with the registry value ScriptingPerUserAccountExecute = 1 under HKEY_LOCAL_MACHINE on the PC, users with S_SCR get full scripting and everyone else read-only scripting (SAP Note 2565390). Parameter effects are from the SAP GUI Scripting Security Guide; check each in RZ11 on your release.
SAP GUI scripting security: what to tell your security team
PostNow.ai uses SAP GUI scripting inside the user's own session, so it adds no permissions: SAP sees the same user, runs the same authorization checks and applies the same field checks as for typing. SAP's own Security Q&A says the same: a script can only reach data the user may see.
The real concerns are the ones SAP lists, and each has a control:
| Concern | Why it is real | Control |
|---|---|---|
| Speed and volume | A script works much faster than a person, so a wrong script can enter more bad data before anyone notices. | Limit scripting to named users with per_user; in PostNow.ai, Validate the sheet and Simulate in SAP before Run. |
| Scripts that run unnoticed | A script could attach to a session the user is working in. | The notification popups, or force_notification from the server. |
| Screen data copied out | A script can read every cell of a table control or ALV grid on the screen, even when list download is not allowed. | disable_recording, per_user, or no scripting on systems that hold the most sensitive data. |
| Passwords in script files | A VBScript that logs on often carries the password in plain text. | SAP advises never to write passwords into scripts. PostNow.ai keeps the user's own SAP login encrypted for that Windows user on that PC. |
| Control on the desktop | The PC switch is per user unless IT locks it. | Set UserScripting centrally under HKEY_LOCAL_MACHINE, or install SAP GUI without the scripting component. |
The usual compromise is sapgui/user_scripting = TRUE with sapgui/user_scripting_per_user = TRUE, and S_SCR in a role for the people who need it. For a PostNow.ai rollout, that role goes to designers, operators of recorded templates and testers with SAP GUI steps.
Troubleshooting: popups, greyed-out options, scripts that cannot attach
PostNow.ai names the switch that is off; the table covers the cases behind that message and the ones a VBA macro meets.
| Symptom | Cause | Fix |
|---|---|---|
| Scripting worked yesterday and is off today | The value was set only in RZ11, and the system was restarted | Add sapgui/user_scripting = TRUE to the instance profile |
| It works on some logons and not others | Set in RZ11 without Switch on all servers, or the profiles differ between application servers | Set the value on every server, then compare RZ11 per server |
| RZ11 was changed, but the session still says scripting is disabled | The session was open before the change | Log off and log on again |
RZ11 does not find the parameter, or the value stays FALSE after saving | Parameter not found: support package level too low. Value stays FALSE: typed in lower case, or the kernel patch is missing | Enter TRUE in capitals; if it still stays FALSE, Basis checks the kernel patch level |
| Scripting works on the logon screen, then stops after logon | sapgui/user_scripting_per_user = TRUE and the user has no S_SCR | Assign a role with S_SCR, activity 16 |
| A popup asks whether a script may attach, on every run | The notification boxes are ticked, or Basis set user_scripting_force_notification | Clear both boxes in SAP GUI Options if your policy allows; otherwise the server setting wins |
| Enable scripting is greyed out | IT set the option centrally | Ask desktop IT to allow it for the users who need it |
| A script reads values but cannot type into a field | user_scripting_set_readonly or nwbc_scripting | Full scripting for the users who post, for example through per_user and S_SCR |
| Script Recording and Playback records nothing | user_scripting_disable_recording | Record on a system where it is FALSE; playback still works |
VBA errors such as 619, "The control could not be found by id", come from the script, not from the switches; they are covered with the other script failures on the SAP GUI scripting alternative page.