Re: Users with *ALLOBJ

years ago, I setup JDE to use adoptive authority.. this way you can remove *ALLOBJ from the users.

Create an OWNERSHIP Profile that can't log in.  Grant *ALLOBJ to this Profile.
Change the object ownership of ALL JDE programs to this Profile..

Next:  Change the programs to be USRPRF(*OWNER).

The result?  When using JDE, the effectively operate as before with *ALLOBJ.  Outside of JDE..  NO.
One thing.  You must prevent them from being able to get to a command line from within JDE for this to be effective Security.

I'm sure people can poke holes in this strategy, but this was the approach I took and it worked well.

Gavin .

On 5/11/2024 1:58 PM, ubelhor@xxxxxxxxxxxxx wrote:

Hello:
We are process of a task to get rid of *ALLOBJ authority for system users.   Out of hundreds of profiles with *ALLOBJ we are down to 9 system users that have *ALLOBJ.   They are in the finance group and insist they must have the *ALLOBJ authority.    We are tackling the users 1 at a time out of the 9 to see what they actually need for authority and ultimately get the *ALLOBJ removed from their profiles.   It was discovered that over the years by default user profiles had been copied and no one really considered the impact of *ALLOBJ.
We don't necessarily want to put in a package.   Just want to deal with sorting out safely what the 9 system users really need for authority.   They are using JDE World (green screen) and also have a bunch of add on applications.   Do you have any recommendations on how to  most efficiently address the task?
ThanksRegards,Laura
Laura A. UbelhorPresidentConsultech Services, Inc.www.consultechservicesinc.com
phone 248-701-7410