Re: Enable Disabled Users and Devices

date: Tue, 2 Nov 2021 13:37:34 +0000
from: Kevin Bucknum <Kevin@xxxxxxxxxxxxxxxxxxx>
subject: Re: Enable Disabled Users and Devices

It should be pretty easy to write something that finds the disabled
profiles and re enable them. You've seen the disabled user id query that K
Crawford sent, that gives a lot of info, but for your case, you may want to
look at qsys2.user_info. It should have everything you need for identifying
the users. For devices, not sure.

Just a thought. For me, I would be wary of something that automatically
renables user profiles. It will create (at least for us) another report
that must be checked every day. If your users have command line access,
this is what I would do.

Create a command and cl/rpg that just takes a user profile (or devd).
Command processor has an owner with proper authority, and you adopt
authority. It also does some logging, and sends a break message to
somewhere monitored. Make the command and processing program *PUBLIC
*EXCLUDE, put everyone that you trust to run the command into a group
profile, and give them access to the command/processor.

If it is happening enough that you expect reports everyday, then just flat
out automating it would work, but you really need to fix the user problem
and not just through a bandaid over it. If it's not, then certain users
have the ability to fix it for other users without involving IT, but you
still get a notice when it is happening, and you can address repeat
offenders as necessary.

For us we were only concerned with a few specific user profiles.
One for time clock and one for Employee Leave.

I'm sure there is a better way to grab the actual message from QSYSOPR and
get the variables in CPF1393.

This accomplished what we needed to do.

We have bus drivers and custodial staff clocking in all hours of the day.
Have a knack for disabling the user profiles.

Bob Schwartz
Director of Technical Services
Glynn County Board of Education
1313 Egmont Street
Brunswick, GA 31520