We run World 7.3 also,, working off of G94 menu, the user security. We have the user key value for the DP, set, for users in the A/P group, tied back to the menus, so that only certain users  are allowed into the A/P sections. Do you run custom menus, or is everyone running off off, the standard JDE menus? There is also, a better web site for jde users. www.jdelist.com. You might check out that site.

Thanks for the help. I'm new to this website and it takes a little getting used to. We use the JDE standard menu sytem. What we want to do is create JDE groups and assign menus to those groups then assign users to the groups. I have found limited information on groups and I could not find any
information on defining classes. I'm using the JDELIST website as well thanks for the suggestions.

Just finished doing something similar - too long to post the steps here - email me & I will give you more info - louiste2@aol.com.

With several questions regarding a security approach to take, here is some info that may be useful. The 3 most commonly used Security Models are:
1.) Menu Masking
2.) Grant All - Deny individual access (All Access plus
    Action Code Security for Denied programs)
3.) Deny All - Grant back individual access

If you are required to provide audit info on what transactions/functions a user has access to, I recommend Opt 3 - the DENY ALL strategy (Vs using Menu Masking and/or Denying access to Sensitive programs only).

Deny the Group/User access to everything & grant back access to individual programs. This is a bear to set up, but requires the least maintenance and is the easiest to report on for an Audit. Although work  intensive, it is fairly simple to convert your existing Security strategy to DENY ALL.
1.) Duplicate each GROUP on JDE, suffix with a '2'.
2.) Create duplicate User ID's, suffix with a '2' and   
    attach to the new Group.
3.) Deny All at the Group Level.
4.) Grant back common access at the Group level
5.) Grant back individual User access if necessary

After granting access to Programs for Groups/Users that are required, have Users do their daily tasks using the new User id's for a 2 or 3 week period. This will let you know what one-off access a User(Group) will require.

Try www.alloutsecurity.com. They have free whitepapers.