Limit HR access while payroll is running

We are moving from LAUA security to Lawson Security and we wanted to know how to limit HR's access to update data while payroll is running.

We currently have a script that our Payroll dept runs that changes the security class that the HR employees are under so they have limited update access. Once Payroll is done they run another script to change HR employees back to their normal class. With the new Lawson security we are not sure how to get to this to change it.

How is everyone handling this? Does anyone use a script to change employee Roles while payroll is running?

Thanks!

Find more posts tagged with

Infor Lawson Human Resources Group - Discussion

Comments

unknown

What you are doing sounds exactly like what we used to do when we were on LAUA. What we do now - We have a record in PR20.4 (PRPAYCODE) for each company with a pay code of "PRP" (for payroll processing). Our payroll manager changes it from status "A" to "I" when she is ready to limit their updates, and changes it back to "A" when payroll is finished. Any security rules related to changing information query this record and check the status. If status is "A" they can update, if "I" they cannot.

unknown

That would be easier... does that mean you have put this rule on every form that you want to limiit so that the Add, Change, Delete are based on this?
Would you be willing to share the rule that does this?

unknown

Yes we do put this rule on every form we want to limit - thank God for cut and paste!
Note that we also are using COMPEMP to say basically - is this my employee record we're looking at? I should just be able to touch my own record.
Then it queries the status of the PRPAYCODE for company code and paycode PRP.
I didn't write this so I can't take the credit, but it works great. The PR manager flips the status as part of her normal payroll processing when she wants to stop them from adding banks, updating address, whatever.

if(isElementGrpAccessible('COMPEMP','','PR',form.EAD_COMPANY,form.EAD_EMPLOYEE)&&getDBField('PRPAYCODE','ACTIVE-FLAG',user.getCompany(),'','','PRP')=='A')
'ALL_ACCESS,'
else
if(isElementGrpAccessible('COMPEMP','','PR',form.EAD_COMPANY,form.EAD_EMPLOYEE)&&getDBField('PRPAYCODE','ACTIVE-FLAG',user.getCompany(),'','','PRP')=='I')
'I,N,P,T,'
else
'NO_ACCESS,'

unknown

Wow.. thanks so much.. we are new to Lawson security and writing rules so this will help out a lot!

unknown

Hi we dont restrict our hr users but do restrict self-service access. We implented lawson hr/payroll last year and the technical consultant we had helped us set up a job that our users can run that remotely submits batch files on our webservers to swop out html pages - so the job they run at the start of payroll changes the html page (ddmain.htm is one that it touches) to an html page that just has a message on it saying that functionality is unavailable. And then at the end they run another job that restores the original htm page.

0911060553270289.pdf

unknown

Thanks Lesley, I hadn't thought about Self Service side.

sriman-shivakoti

We restirct SS users by querying the "*" on the PR00 so it is automatic.

unknown

Great idea Margie! I love all these ideas.... Thanks so much!

dangeli

As an FYI, there is an enhancement to EMSS with the 10.0.2.0 version to "lock out" certain tasks during a payroll run. The enhancement is as follows....

Feature: Payroll "Lock Out" Functionality
Description: A new configuration setting has been added to the emss_config.xml filecalled "payroll_lockout" which provides the ability to prevent employees from accessing payroll-related information within the following tasks: Direct Deposit, Tax Withholding, or Address Change. The default value of this setting is "false", meaning that EMSS will not prevent any payroll-related updates. A new back end, HS18.1 Payroll Lock Out Rules program, has been created that provides the ability to define a “lock out” date range and time frame for each of Direct Deposit, Tax Withholding, or Address Change respectively. If the “payroll_lockout” setting is set to “true” and access is denied based on the lock out date and time defined for the appropriate HS18.1 rule, an edit will be displayed to the employee they cannot access the task due to a payroll cycle in progress.

Related JTs: JT-114437, JT-336319

For HR 4GL 9.0.x, requires 9.0.1 MSP#9 or higher
For HR 4GL 10.0.x, requires 10.0 MSP#2 or the CTP for JT-336319

Kevin Suhsen | Senior Support Engineer | Infor S3 HR Support

unknown

Thanks Kevin... that's good to know!

sriman-shivakoti

Something to think about and perhaps request as an enhancement is to have the lock out feature available at a level lower than just at the company. Several of us who attended the session at Inforum suggested it may be beneficial to have it available to lock out by process level. Some even wanted it by department - I am not sure about that level because you can't run a payroll by dept. A few also mentioned by process group which would be a combo of PLs.

dangeli

HS18 does have an Employee Group field on it. Couldn't you create an employee group based on a process level, process levels, departments, etc. and use that as a filter for affected employees? I think this would be more flexible since you wouldn't be restricted to just process level or department. You could base it on location, pay plan or most anything else on HR11. Obviously there is a little more work creating the employee groups but from what I have seen, clients have a fair amount of employee groups and may likely already have one that fits this need.

Kevin Suhsen | Senior Support Engineer | Infor S3 HR Support

sriman-shivakoti

I missed that field when the slide was shown. Great option.

We have a fair amount of employee groups. I am certain one of the existing groups we have would suffice.

Thanks.

0905290750040159.pdf

Copyright © 2025 Infor. All rights reserved.