If I'm understand the help desk folks in order for me to lock down someone to view only access - no ability to add, update or change anything, I'd have to practically go into every form in HR / BN / PA / GL / PR and take out the add/change codes. That CAN'T be right - it is ILLOGICAL that it could be that complicated and time consuming.

I was able to set the data area (define data security) for Company & Process Level to Inquiry only - but understand that this affects only forms that have Co & PL on them. Any forms without those will have to be locked down via form security. However, to determine which of the massive forms in the system do not have these (being new to Lawson), I'd have to open each forms SCR file to see if it does or does not update the Company or Process Level. That would take a LONG time. Seems someone would have merged all of these scr files allowing a quick Excel filter or something.

I'm hoping that I'm just naive as there MUST be a better way.

I feel like I'm in the twilight zone - please help.

I justed tested using data security on the Company field and GSC is correct. I can change data on any form that does not have the Company field. The not so bad news (didn't want to call it good news) is that there are very few forms, at least in the HR/PR suite, that don't have a Company field. Unfortunately I don't have a list of them, although I do know PR01, HR03 and HR04 are among them.

For me, it's turned out that most "read-only" users only need access to a limited number of forms, so it would probably be easier to remove all the forms they won't be using than to go through every form to see if it has a Company field.

Sorry I didn't have a better answer.

Unforntunately, there really isn't an easier way. I'm sure everyone at some point tried setting the data security to Inquire Only - but it doesn't really work that way. I believe that setting may also prevent you from doing some job adds too, but I'm not sure. The only real way to make somebody read only is to remove all update (and purge, conversion, etc. - basically everything except the XX200's) batch jobs and then remove all the Function Codes on each online screen except for "INP+-".

There is a way to minimize the effort though. KarenPloof is right, most of these 'read only' users definitely do not need all of the screens and hopefully just a handful. Most modules have a pretty good set of Inquire screens (XX90's) and whatever doesn't show up there can usually be found through the drillaround.

-GW