Hi Arya
I haven't commented no this post much as Bernard already jumped in. I agree with his suggestion to switch on logging for the one user. I haven't worked Germany market for privacy rules but are you able to ask the user for permission to temporary switch on whilst you troubleshoot. Ask your compliance or audit team if you could get an exception here. If the user cannot logon to the system they might be willing to allow this
Now if there is a chance of some code related bug (maybe a developer coded somewhere for that specific Id) you could try to create the account in non production and then log/trace there.
For tracing, I would consider ST05 SQL and ST01 for kernel/rfc to attempt to pick up the user and see how far it gets. It might show tables, etc being checked. I'm not a programmer but pretty sure you can't put a break point and debug this as this section of the code for logon sequence is protected. However, if there is some bad code out there it might be causing the password change prompt just after the logon sequence.
Do you get change documents for resetting of the password coming up all the time? Might be a stupid question, but is the user actually changing their password and not pressing cancel? Also, are they logging straight into to SAPGui or some other tool?
Guessing game and suggestion is to:
- try to deactivate password and reissue
- temporarily switch account to service user so password rules are not enforced - if change prompt comes up it might lead back to some code bug
- Copy the user and see if it happens to this account
- Delete (I hate suggesting this) and recreating the user
If you still can't get anywhere, it sounds like you need to raise a marketplace message and have SAP experts access system on secure connection to investigate.
Regards
Colleen