Access Change Agent - Manager to Designer

HCL Domino Domino Forum
1

We have wanted, for quite some time, to change all of our users’ access from manager to designer to prevent them from doing such things as changing their acl’s or deleting their mail files. Since, in r6, none of the users’ necessary notes functions are adversely affected by this change, we are going to move forward with it.

I wrote a LS agent to do this. In addition to changing every entry of person type with manger access to designer/person type, it also removes (incase it already exists with the wrong access) and adds in our admin group with manager access. Finally, it enforces a consistent ACL on each mail file.

Note:

This can run in the background or the foreground, but the signer of this agent, must, of course, have manager access, AND, the entry that is giving manager access to the agent signer must NOT be of a person type. Otherwise, this entry will also be yanked out and changed to designer. I would recommend running it in the background and signing it with the server ID, which should have an entry in the ACL of either server type or server group, and subsequently, will not be touched by this agent.

I have tested this on 6x servers only, but believe it will also work on 5x servers.

Perhaps someone will find it useful.

Sub Click(Source As Button)

On Error Goto ErrorHandler



Print "Acl Change Agent Begins"

Print "Acl Change Agent Begins"

Print "Acl Change Agent Begins"	



Dim dbdir  As New NotesDbDirectory( "Trnss01" )	

Dim db1 As NotesDatabase

Dim nextentry As NotesACLEntry

Dim entryname As String

Set db1 = dbdir.GetFirstDatabase(DATABASE)

While Not(db1 Is Nothing)

’ "mail\” listed below is case sensitive so if your server has the mail directory as “Mail” or “MAIL”, or whatever, instead of “mail”, you will need to change this line below, accordingly.

	If Left$(db1.filepath, 5) = "mail\" Then

		Call db1.Open( "", "" )

		Set acl = db1.acl

		Set entry = acl.GetFirstEntry		

		Call db1.RevokeAccess( "Administrators/AIS/US/Ahold" )

		Set adminACLEntry = acl.CreateACLEntry( "Administrators/AIS/US/Ahold", ACLLEVEL_MANAGER )

		adminACLEntry.isPerson = True

		adminACLEntry.isGroup = True			

		Call acl.save

		While Not  entry Is Nothing

			Set nextentry = acl.GetNextEntry(entry)

			entryname = entry.name

			If ( entry.Level = ACLLEVEL_MANAGER ) And ( entry.isperson =True ) And (entry.isGroup = False) Then

				Call entry.remove	

				Call acl.save	

				Set notesACLEntry = acl.CreateACLEntry( entryname, ACLLEVEL_DESIGNER )

				notesACLEntry.isPerson = True

				Call acl.save					

			End If				

			Set entry = nextentry

		Wend

		acl.UniformAccess = True

		Call acl.save

	End If

	Set db1 = dbdir.GetNextDatabase		

Wend

ErrorHandler:

If Erl() <> 0 Then

	Print "Got error " & Error$ & " on line " & Cstr(Erl)	

	Resume Next		

End If



Print "ACL change agent is done"

Print "ACL change agent is done"

Print "ACL change agent is done"

End Sub