Group profiles can simplify authorization management, but if not used properly, they can actually create problems and decrease system performance. Follow these guidelines for group profiles.
? To eliminate the chance that someone will sign on with a group profile, use the special password value of *NONE for all group profiles.
? For users who are members of group profiles, consider assigning object ownership to the group profiles rather than to the user profiles. When you create a user profile with the Create User Profile (CRTUSRPRF) command, set the OWNER parameter value to *GRPPRF rather than the default of *USRPRF.
? If you discover that a user has authorities that should belong to a group profile, do the following:
1. Use the Grant User Authority (GRT-USRAUT) command to give the user's authorities to the group profile.
2. Use the Revoke Object Authority (RVKOBJAUT) or Edit Object Authority (EDTOBJAUT) command to remove the private authorities from the users, because they are no longer needed.
-Steve Bisel
LATEST COMMENTS
MC Press Online