Thanks Rich,
I'm not sure I can shut down *REXEC until this evening as we have numerous workers in the field, this would impact.
What I can't figure out is what is trying to do this. I can't identify anything that should be sending remote commands for this user.
I have a monitor set for this, and they are literally coming in every second for this user. I had to hold the monitor as I was being bombarded with notifications.
Mike
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxx> On Behalf Of Rich Loeber
Sent: Thursday, May 17, 2018 10:24 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Subject: Re: invalid password and QZRCSRVS
Mike,
These are remote command attempts. You might try shutting down the *REXEC
TCP server and then restarting it to see if that stops the behavior.
Rich Loeber - @richloeber
Kisco Information Systems
[1]
http://www.kisco.com
--------------------------------------------------------------------------
On 5/17/2018 10:00 AM, Smith, Mike wrote:
This is an issue I have encountered once or twice recently but really don't know how I can diagnose or at this point even stop.
This morning I had a user change their IBM I password. Immediately after they signed o, I started receiving invalid password attempts and their profile being disabled.
This user is primarily a green screen user, although she does occasionally sign on to a scan station to scan documents. She doesn't access through IPAD or anything like that(or so I'm told)
I found 3 or 4 jobs with her name on it attached to QZRCSRVS. I thought if I ended those it might end the problem. It did not.
Now I am still getting the invalid password attempts but when I look at the job causing them they are still QZRCSRVS, but associated with QUSER.
If I enable her password, within seconds it is disabled again. I can't get her enabled long enough for her to even sign on.
Any ideas how I might diagnose this problem?
Thanks
Mike
NOTICE: This message, including any attachment, is intended as a confidential and privileged communication. If you have received this message in error, or are not the named recipient(s), please immediately notify the sender and delete this message.
References
Visible links
1.
http://www.kisco.com/
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
http://amzn.to/2dEadiD
NOTICE: This message, including any attachment, is intended as a confidential and privileged communication. If you have received this message in error, or are not the named recipient(s), please immediately notify the sender and delete this message.
midrange.com
