RE: Auditing, renaming, deleting IBM profiles

That's no problem, if done right.

Services don't use that account (normally), and you can even use
group policies to automatically rename the local administrator on
client machines, etc.etc.

Submitting a DCR about this is absolutely a good idea, IBM should
provide a way to do this.

It would be a very nice feature, though Windows is the only OS I can think
of that has it. UNIX/Linux both have standard profiles that I don't
believe can be changed or deleted (well you can, but you won't like the
results if you delete CRON or root).

Of course with Windows tons of things are already running in ring 0 and
are at the highest levels of access anyway. In i5/OS they would have to
change a lot of internal code from just checking for the user being
qsecofr to looking up the name of the designated profile, then checking
for the user.

Which leads to questions of how you protect that value in memory and in
DASD, how you insure that no profile is deleted until you make sure it
isn't the designated profile, what kind of conversion of ownership will
you do if the designated user is changed, how you will ensure those
objects are not locked, etc.