RE: Auditing, renaming, deleting IBM profiles

It would be nice if IBM created a system value for each of their
profiles allowing you to rename them. Much like the local security
policy that windows has that renames and tracks the name of the local
admin profile under windows XP. We use this local security policy to
rename our admin profile then create a new admin profile with guest
authority and a very complex and long password. Sort of a honey pot. I
would like to do that with the IBM supplied profiles.


Chris Bipes
Director of Information Services
CrossCheck, Inc.

-----Original Message-----
From: midrange-l-bounces+chris.bipes=cross-check.com@xxxxxxxxxxxx
[mailto:midrange-l-bounces+chris.bipes=cross-check.com@xxxxxxxxxxxx] On
Behalf Of ALopez@xxxxxxxxxx
Sent: Wednesday, July 25, 2007 8:02 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Auditing, renaming, deleting IBM profiles

Other than "common knowledge" that IBM user profiles should not be
renamed or deleted, is there any official IBM documentation stating

the

fact? We have auditors who want to rename or delete QSECOFR, QUSER,
QSRV, QSRVBAS, QPGMR, QSYSOPR, &c. I found and printed IBM's command
help for DLTUSRPRF that restricts deleting those profiles, but have

not

seen anything on a rename.

In addition to Barsa's note about IBM not supporting the renaming of
user
profiles, those add-on utilities that do support it (i.e., TAATOOL),
won't
do it for IBM supplied profiles.

Ask these idiot auditors exactly how they would recommend renaming IBM
supplied user profiles. There are no APIs that will do it. There's no
third-party utilities that will do it. While there would be ways of
hacking the system to do it (at least before V6 of the operating
system),
all those ways would break the operating system.

Quite simply the auditors won't know how to do it because, much like
Unix/Linux, you can't exist without those profiles and they can't be
renamed without re-writing the operating system.