Re: Users with *ALLOBJ

Thanks Mark.
Laura A. UbelhorPresidentConsultech Services, Inc.www.consultechservicesinc.com
phone 248-701-7410

On Monday, May 13, 2024 at 01:18:18 PM EDT, Mark Waterbury <mark.s.waterbury@xxxxxxxxxxxxx> wrote:

CHGPGM ... USRPRF(*OWNER) destroys the old instance of the program object and creates a new one.  This will be very bad if done while users are in the system using these applications.  So, you need to plan to do this during "off-hours" when no interactive users or batch jobs are running.
The help text for CHGPGM describes this.
This problem can also happen if you restore objects into a "live" production library while users are using the application.
Plan accordingly.
  > On Monday, May 13, 2024 at 10:13:32 AM EDT, Gavin Inman <midrangelist@xxxxxxxxxxxxxx> wrote: 

years ago, I setup JDE to use adoptive authority.. this way you can
remove *ALLOBJ from the users.

Create an OWNERSHIP Profile that can't log in.  Grant *ALLOBJ to this
Profile.
Change the object ownership of ALL JDE programs to this Profile..

Next:  Change the programs to be USRPRF(*OWNER).

The result?  When using JDE, the effectively operate as before with
*ALLOBJ.  Outside of JDE..  NO.
One thing.  You must prevent them from being able to get to a command
line from within JDE for this to be effective Security.

I'm sure people can poke holes in this strategy, but this was the
approach I took and it worked well.

Gavin .

On 5/11/2024 1:58 PM, ubelhor@xxxxxxxxxxxxx wrote:

Hello:
We are process of a task to get rid of *ALLOBJ authority for system users.   Out of hundreds of profiles with *ALLOBJ we are down to 9 system users that have *ALLOBJ.   They are in the finance group and insist they must have the *ALLOBJ authority.    We are tackling the users 1 at a time out of the 9 to see what they actually need for authority and ultimately get the *ALLOBJ removed from their profiles.   It was discovered that over the years by default user profiles had been copied and no one really considered the impact of *ALLOBJ.
We don't necessarily want to put in a package.   Just want to deal with sorting out safely what the 9 system users really need for authority.   They are using JDE World (green screen) and also have a bunch of add on applications.   Do you have any recommendations on how to  most efficiently address the task?
ThanksRegards,Laura
Laura A. UbelhorPresidentConsultech Services, Inc.www.consultechservicesinc.com
phone 248-701-7410