DNA$SESSCTRL is inactive

[Manny DeAssis]

I'm running VMS V7.3-2 with DECnet Plus V7.3-2 ECO 1. The UAF record for DNA$SESSCTRL shows it been inactive for years. I'm going to recommend that it gets removed. However won't it just get created again the next time a DECnet ECO is applied? Does it need to be around for file ownership reasons? Please advise. Thanks.

[Ian Miller.]

I think its a leftover from earlier version. I've just looked at VMS V7.3-1 AND v7.1 system and its not there.

Check for any files owned by that UIC before deleting
(
DFU SEAR /OWN=uic device
or DIR/BY_OWN=uic device
)

[John Gillings]

Manny,

If you want to play cautious, just disable the account:

UAF> MOD DNA$SESSCTRL/NOACCESS/FLAG=DISUSER

This disables the account in two ways. Keep an eye on login failure audits to see if anything attempts to use it.

If you do decide to remove the record, consider leaving the rights identifier:

UAF> REMOVE/NOREMOVE DNA$SESSCTRL

This will help prevent reusing the UIC, and will retain the name if there are any owned files or objects - a good policy (IMHO it should be the default for REMOVE!)

[Manny DeAssis]

Thank you for all your responses. I will most likely consider leaving it alone or use the 'remove /noremove' solution. Thanks again.

[Jan van den Ende]

John,

caught you again in a very good suggestion!

Any more voters to promote that to an official request level, please?

Cheers.

Have one on me.

Jan

[Ian Miller.]

http://www.hpuseradvocacy.org/
is waiting for that suggestion :-)

[Jan van den Ende]

Sorry,

should have made myself more clear.
I directed my previous post at
" good policy (IMHO it should be the default for REMOVE!)

Cheers.

Have one on me.

Jan

[Jan van den Ende]

Ian,

you _ARE_ quick!

Yes, I agree, but;

a. John's idea. HE should have the credit of posting
b. over here it is probably getting more attention
and, sadly, and as an excuse :-(
c. somehow my access to various HP sites has (historically) gotten confused between logins at the European/EMEA and the USA sites, and any correction to one issue out of that generates trouble in accessing other(s).
I learned to live with the current Status Quo, and when needed I just (ab-)use ITRC (or various Mail-to's) to circumvent that.

Sometimes it reminds me of using billyware 8-(((

Anyhow:

Cheers.

Have one on me.

Jan

[Martin P.J. Zinser]

Hello Manny,

you might also want to check if the account is
associated with any known DECnet objects before removing it.

Greetings, Martin