RE: Auditing, renaming, deleting IBM profiles

Take another look at iSeries i5OS accounts. There is a UID and GID,
(User ID and Group ID).

Chris Bipes
Director of Information Services
CrossCheck, Inc.

-----Original Message-----


There's a big difference though. Internally, and in references to it
(like ACLs on a file) a windows user profile isn't referred to by its
name, but rather by its SID, basically an internal identifier for the
user. Therefore, when you rename the admin account, you don't break the
link for permissions granted to the user since the SID doesn't change.
However, on the iSeries, the reference to a user profile is by its name,
there is no SID. So if you changed QSECOFR to BIGGUY you'd have to find
every reference (including those hard-coded in OS/400) and change it
there too. The upside for OS/400 here is that if you delete a profile
and then re-create it all the references are intact. Whereas, if you
delete a windows profile and then recreate it it gets a new SID, so
you've lost all the references; that is, if you delete windows account
Bob and then say "oh shi..." you can't simply recreate bob, it would be
a totally different account.