In a test or production client, obviously you want to block configuration changes. A problem this can raise, however, is when adding master data to a production or test client. The issue is that SAP by default wants to tie any master data changes to a transport, thus requiring the client to be set to modifiable or customizing. When hiring a new employee in PA40 is one example of a time when you need to add master data to a closed client.
The solution to this is to tell your system to not tie master data changes to a transport by default. To do so, run transaction OOCR. In the entry for TRSP CORR you need to flag it with an 'X' to deactivate the automatic transport connection.
Hope this helps...
