OBJMGT Permissions

I'm trying to create another "administrator" profile because I don't want to use QSECOFR for daily tasks.  I copied the new profile directly from QSECOFR but it is not working like it should.  From what I can tell if the profile does not have access to the Object Management authority (*OBJMGT) then the profile can't do tasks such as specify security, move or rename the object, and to add members.

The new profile does have the following permissions:
*ALLOBJ  
*AUDIT    
*IOSYSCFG
*JOBCTL  
*SAVSYS  
*SECADM  
*SERVICE  
*SPLCTL  

I have attached two screenshots of how it should look running wrkusrprf with the QSECOFR's account and the new admin account.
shot1.jpg
shot2.jpg
Josh HindSystems AdminAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Gary PattersonConnect With a Mentor VP Technology / Senior Consultant Commented:
Just make the profile a member of the group QSECOFR - no need to specify.
0
 
Josh HindSystems AdminAuthor Commented:
I already made the new administrator account a member of the QSECOFR group.
0
 
MurpheyCommented:
Try to clear your signon program and initial menu,
It's possible that you  adopt the rights from the program (if it was compiled withg *OWNER

Regards,
Murph

0
 
tliottaConnect With a Mentor Commented:
MRGCD-IS:

The two different screens are due to the difference in "assistance level". This is set (1) at a system level via the QASTLVL system value, (2) for individual profiles via the ASTLVL() profile attribute accessed with CHGUSRPRF and CRTUSRPRF, and (3) via actions taken by the user for any IBM function that supports it.

I could make guesses why you see the pattern that you show, but it's easiest just to say how to fix it (assuming the most common reason for this happening).

When the "Change User" display appears (as in the second screen-shot), press <F12> to exit back out to the "Work with User Enrollment" screen. Press <F21=Select assistance level> and change the level from 1=Basic to 2=Advanced.

Once the assistance level is changed for the new profile, the two profiles should show the same screen appearances. But note that this is likely going to need to be repeated for different functions. This is _probably_ because someone did this at some time in the past for your QSECOFR profile. New profiles that are copied from QSECOFR won't get copies of the "function" changes; only the overall ASTLVL() attribute would be copied.

Tom
0
 
Josh HindSystems AdminAuthor Commented:
Thank you both!
0
All Courses

From novice to tech pro — start learning today.