Re: [Bulk] Re: Determine how pwrdwnsys was executed

Jim:

What do you see when you run:

* DSPOBJAUT PWRDWNSYS *CMD*

What is the *PUBLIC authority to that command? IBM ships it with *PUBLIC *EXCLUDE for a reason. So, how was that user even authorized to run that command, if in fact they somehow did that?

What, if any, special authorities does the user profile have? Does this user who ostensibly ran the PWRDWNSYS command have one or more group profiles? You may also need to look at them to see what special authorities any of those have.

What is the initial program for this user profile? Is it some "vendor" supplied initial program that puts them into the "menu" you mentioned below? Perhaps it uses "adopted authority" ? And, perhaps it is adopting "too much" authority?

And, what about that environment variable QIBM_PWRDWNSYS_CONFIRM -- do you have that environment variable set up "system wide" on your system, and if so, what value is it set to? With this, you could have at least had a notification sent to QSYSOPR, with a chance to reply to prevent the PWRDWNSYS ...

You could also run the IBM-supplied PRTCMDUSG command to search for the PWRDWNSYS command, within your applications, at least those that were in the library list of this one user, to see if somehow, someone has managed to "code" a PWRDWNSYS command somewhere within some program? You could also use PRTCMDUSG to search for INSPTF as that can also cause a "power down" ...

Hope that helps,

Mark S. Waterbury

> On 6/8/2016 10:23 AM, Jim Franz wrote:

we are exploring the I Access logon and any scripts, plus the .ws (I have
to pass on to a network dept.)
I interviewed the user - and she really just signed on - then attempted to
exit the menu.
The menu itself does not link to other menus, but it does have a command
line (and user has limited capability=*no at the time - now *yes)). The
previous posted job log shows pwrdwnsys initiated from her interactive job.
Will see where the macro suggestion takes us..
Jim