RE: User profile question

Joel B. Harvell said,

> If you set a user profile to *disabled it will cause programs that use
> that user profile to fail.
This is not necessarily true. It depends on HOW the other programs expect
to use this profile and HOW they try to run jobs under that profile. This
blanket statement is false.

> Not sure of the wisdom of setting any of the IBM Supplied user Profiles
> to password = *none.  I'm hoping that you haven't set any of the User
> Profiles that have *secadm access set to *none.  Have your SOX auditors
> called you to the carpet for that.
First, in general, it is a good idea to set IBM supplied user profiles to
*NONE.   Second, please append the section of SOX that says anything about
this.  If a SOX auditor tries to ding anyone for this, they don't know what
they're talking about -- unless for some, probably dumb reason, the
company's security policy specifically forbids any userID (on any system)
from not having a password.


> If you are using any of the IBM Supplied user profiles to run scheduled
> jobs, I would recommend setting up clones of those user profiles so that
> you can disable your IBM supplied User Profiles, if your SOX Auditors
We don't encourage any user jobs or applicaitons to rely on IBM supplied
user profiles. So this is a good suggestion. As far as the SOX comment, see
above.

Patrick Botz
Senior Technical Staff Member
Rochester CTC, eServer Security Architecture & Consulting
iSeries Security Architect
(507) 253-0917, T/L 553-0917
CTC Fax # 507-253-2070
email: botz@xxxxxxxxxx

For more information on CTC, visit our website at
http://www.ibm.com/eserver/services
http://www.ibm.com/servers/eserver/services

>
> Joel B. Harvell
> Food Lion, LLC
> (704) 633-8250 x2709
> jbharvell@xxxxxxxxxxxx
>