Re: [Bulk] Re: Determine how pwrdwnsys was executed

Jim:

What do you see when you run:

* DSPOBJAUT PWRDWNSYS *CMD*

What is the *PUBLIC authority to that command? IBM ships it with *PUBLIC
*EXCLUDE for a reason. So, how was that user even authorized to run that
command, if in fact they somehow did that?

What, if any, special authorities does the user profile have? Does this
user who ostensibly ran the PWRDWNSYS command have one or more group
profiles? You may also need to look at them to see what special authorities
any of those have.

What is the initial program for this user profile? Is it some "vendor"
supplied initial program that puts them into the "menu" you mentioned
below? Perhaps it uses "adopted authority" ? And, perhaps it is adopting
"too much" authority?

And, what about that environment variable QIBM_PWRDWNSYS_CONFIRM -- do you
have that environment variable set up "system wide" on your system, and if
so, what value is it set to? With this, you could have at least had a
notification sent to QSYSOPR, with a chance to reply to prevent the
PWRDWNSYS ...

You could also run the IBM-supplied PRTCMDUSG command to search for the
PWRDWNSYS command, within your applications, at least those that were in
the library list of this one user, to see if somehow, someone has managed
to "code" a PWRDWNSYS command somewhere within some program? You could also
use PRTCMDUSG to search for INSPTF as that can also cause a "power down" ...

Hope that helps,

Mark S. Waterbury

On 6/8/2016 10:23 AM, Jim Franz wrote:

we are exploring the I Access logon and any scripts, plus the .ws (I have
to pass on to a network dept.)
I interviewed the user - and she really just signed on - then attempted to
exit the menu.
The menu itself does not link to other menus, but it does have a command
line (and user has limited capability=*no at the time - now *yes)). The
previous posted job log shows pwrdwnsys initiated from her interactive
job.
Will see where the macro suggestion takes us..
Jim

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.