How to get rid of Security Alert BOX?

HCL Domino Domino Forum
1

Hi Folks

Our end users got fed up with Executing Security Alert pop up box. I want to suppress this box and want to give the access to R3 and R4 databases on R6 server with R6 clients.

Somewhere I read that… If we enable the Desktop Policies then users won’t get the popup boxes. But still I’m getting pop up boxes for some users on different PCs.

Also tried to Sign all the databases with the server ID and no luck.

Is anyone know… How to get rid of the Execution Security Alert Pop up???

And anyone know… how can I safely turnoff the policies if it is not going to work the way we want.

Your valuable help will be APPRECIATED.

Thanks

Gopal Paruchuri

2

Subject: How to get rid of Security Alert BOX???

I am assuming your users are on a version of 5 or 6 clients… If so… then you need to take care to have a limited number of id’s being used to sign applications in your environment… eitherwise the local ECL will need to have permission granted on each client before the alert will go away. You can push down ECL settings to the users from profiles (which you should do) but I dont recommend using wildcards like */yourdomain in ECL settings so you will still want to control how many ids are available for signing applications. Your best bet (after Q/A) sign all database designs with the same id.

3

Subject: RE: How to get rid of Security Alert BOX???

I have signed all the databases with server ID. All my clients are using R6. Any suggestions?

4

Subject: RE: How to get rid of Security Alert BOX???

You can’t push ECLs down via Profiles; you have to use Policies, which are only supported by the R6 client. If your clients are all on R6, you can use a Policy to enforce security settings which dictate that users should refresh or replace their local ECLs from the admin ECL either daily or whenever it changes. Make sure you choose the replace option, or your ECAs will continue to pop up for some users and slowly dwindle as they click Trust Signer.

I would agree that using */YourOrganization is a security hole that might be significant in a large company with “uncontrollable” developers, but for smaller firms with less stringent security needs, it’s often simpler to do that than creating and implementing an authorized user ID for template signatures.

5

Subject: RE: How to get rid of Security Alert BOX???

Thanks for your reply. Our users are using R6 Clients.

In Desktop policies… what are the things I need to select or deselect? I checked all of them for default user but not working properly.

6

Subject: Your company needs to decide upon a application deployment strategy

Part of using Lotus Domino is coming up with a good procedure for deploying applications. That involves things like setting standards for database Access Control Lists (ACLs), IDs to use for signing applications, settings for Execution Control Lists (ECLs), and Security policies.

For example, all your DBs might have “CompanyNameAdmins” in the ACL as manager. Similarly you might sign all applications with “Signing Authority/CompanyName” before making them available on servers.

To do this you would use a Security Settings Policy, and on the ECL tab (shown below) you would create a new ECL (perhaps named “CompanyECLStandards”) where you would define what you want “Signing Authority/CompanyName”" to be allowed to do.

7

Subject: RE: Your company needs to decide upon a application deployment strategy

Thanks for your detailed reply. I have signed all the databases with the server ID and in the ECL… I have added the Server name and checked all the boxes in Allow list for Workstation Security, Java Security and JavaScript Security.

Still its not working. I just created a Desktop Policy document. Is there any policies also req prior to create a Desktop Policy Document?

8

Subject: RE: Your company needs to decide upon a application deployment strategy

refer back to Alan’s post; it’s a security settings doc you need to create, not desktop.

9

Subject: How to get rid of Security Alert BOX???

Look under ECL in Help… I can’t remember the exact location, but in the Domino address book (maybe Actions) you can Edit the ECL, this is what tells the server who to Trust… then once you change that… you need to send a button down to the users… that refreshes their ECL… maybe someone has the code for the button, it’s been so long I forget it…HTH

Ruth

10

Subject: RE: How to get rid of Security Alert BOX???

Can you pls check where exactly I need to do the above procedure?

Thanks alot