RE: SPLCTL authority removal

Curious if you've talked to CMS/Epicor ?

I wonder if you can provide appropriate authorities to the STRPRTWTR commands to get them to work ?

Or write your own that wraps STRPRTWTR.

Did the security provide give any specific assitance/recommendations for this issue ?

Just thinking out loud.

Regards,
Richard Schoen
Web: http://www.richardschoen.net
Email: richard@xxxxxxxxxxxxxxxxx

----------------------------------------------------------------------

message: 1
date: Wed, 11 Dec 2024 16:01:12 +0000
from: Bill and Lisa Howie <blhowie66@xxxxxxxxxxx>
subject: SPLCTL authority removal

Hello all,

We're going through remediation for a pen test that was done at my company. A LOT of the normal users in the plants have both JOBCTL and SPLCTL authority. I know that they should ideally not have either one. Removing them is easy enough, but the havoc it might cause is what I want to avoid. We have an ERP system (CMS) that has built-in commands for accessing printer writers and being able to start/stop them. These are pretty heavily used throughout our plants. A colleague reminded me that removing the SPLCTL authority will restrict these users from starting their own printers. I've tested this by making a dummy copy of a typical user's account and removing SPLCTL and then trying to start the printer, and of course it doesn't work.

I'd really like to avoid going through a whole process of changing menus and using adopted authority, etc. to then be able to remove SPLCTL authority. Anyone else had this quandary and found a simple solution? Thanks in advance for any info.

Bill