Hi Bob
I'm not really in a position to provide advise without knowing your system-landscape and what the strategy was for your upgrade as well as security role build.
I read your posts as a contractor did this in Sandpit system but your latest response mentions Dev and QA. I assumed that there was prototyping/testing of upgrade approach. If you are trying to perform a quick fix of Sandpit you can export Development System roles and re-import (or download roles from QA system). This will quickly restore sandpit roles. If you were using Sandpit to test your approach, then download/upload to replace will spoil that.
However, if it a situation where the contractor ran SU25 in a Sandpit client on a Development System then you do have some issues with Development as Steps 2A and 2B are client independent.
How you should be going about this (from a general point of view:)
- Run SU25 Steps 2A-D and Step 3 in your master configuration client in your development system
- Via Step 2C you will fix all roles that had SU24 updates from Steps 2A and 2B
- Step 3 will allow you to transport the entire SU24 definitions - which include USOBX_C and USOBT_C as well as some other tables
- If you for some reason have roles build directly in other clients in development box (e.g unit testing) you will need to log in to each client and fix them directly as Steps 2C and 2D are client dependent
- All roles in your QA system should be transported from Development. Therefore, after the upgrade on QA your security transports should move the changes and you do not run SU25 in QA
Those steps are a very high level. I'm not sure what your background is but based on the questions you have, it seems your site would benefit from a SAP Security Consultant with upgrade expereince coming in and helping you to devise a strategy and document a process to use for Upgrades/Enhancements packs.