FW: who changed the password for a usrprf ?

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
--
[ Picked text/plain from multipart/alternative ]
Jim:  Sorry about that... I meant where PROFILE1 is the profile that did the
changing.  If you don't know that, then you can just enter *ALL, send to a
spool file OUTPUT(*PRINT) and then display the spool file and enter a Find
string.

Steve

-----Original Message-----
From: Steve Martinson
Sent: Friday, February 22, 2002 11:41 AM
To: 'midrange-l@midrange.com'
Subject: RE: who changed the password for a usrprf ?


Jim,

You can see which user profile made the change by displaying entries from
the audit journal (assuming you have journaling turned on).

DSPAUDJRNE ENTTYP(CP) USRPRF(PROFILE1) OUTPUT(*)

Where PROFILE1 is the profile that was changed. You can select specific
journal receivers and dates/times to narrow down the search of the journal
entries.  Output can be spooled as well.

The output will show entry type (CP) and profile parameters across the top,
including the operation used against the profile (CRT - create or CHG -
change).  An indicator of what was changed is shown, such as a "Y" for
'PASSWORD CHANGED' or where a special authority was added.

Steven Martinson
Product Marketing Manager, iSeries and AS/400
PentaSafe Security Technologies, Inc.
http://www.pentasafe.com
Toll Free: 1.888.400.2834, x9585
Direct Dial: 1.713.860.9585

____________________________________________________________________________
__________________________________


Message: 16
From: "Norbut, Jim" <Jim.Norbut@Grubb-Ellis.com>
To: "'midrange-l@midrange.com'" <midrange-l@midrange.com>
Subject: who changed the password for a usrprf ?
Date: Fri, 22 Feb 2002 10:31:34 -0600
Reply-To: midrange-l@midrange.com

Anyway of telling who changed the password for a userprofile ?

I can see doing a dspusrprf to the screen what date it was changed
But it doesn't say who changed it. And there is no entry in QHST stating it
was changed.

This happened today. I am assuming there probably is an API or something.

Jim Norbut
Systems Administrator
Grubb & Ellis Company
Phone   (847) 753-7620
Fax     (847) 753-9854