Does anybody have a tool/script/method that will scan thru all users’ mail databases and if the user themselves is missing from their own mailbox’s ACL list, to programmatically re-add it back it?
We have a number of users mail databases where the users’ own ACL entry got deleted from their own mailbox, more than I really like to fix by hand if there’s a clever way to avoid it.
Subject: Tool or script to mass-edit/repair mailbox ACLs?
Sorry I don’t have a script for you but …at my customers side we are working with
POWERTOOLS from www.helpsoft.com
There is one tool it that I have not used yet but here is what it should do:
Check Mail File ACLs - Checks mail file ACLs to make sure that each mail file has an ACL entry matching the user’s name as it appears in the person document. The user’s new name may be missing if adminp doesn’t complete all tasks during a name change.
If I remember right you can download a trial version. It is a wonderful tool, I use it for many many other admin tasks
Good luck
Peter
Subject: Tool or script to mass-edit/repair mailbox ACLs?
As long as your ID has Manager access to the databases (you can use Full Access Administration and “Manage ACLs->Add/Remove” to accomplish that much), you can use this:
Warning: code is off-the-cuff. If you run into problems, please let me know.
Option Public
Option Declare
Dim s As NotesSession
Dim NAB As NotesDatabase
Dim peopleView As NotesView
Dim personDoc As NotesDocument
Dim mailDb As NotesDatabase
Dim acl As NotesACL
Dim aclEntry As NotesACLEntry
Dim userName As String
Dim mailServerName As String
Dim mailDbFilepath As String
Dim isUserListed As Boolean
Sub Initialize
Set s = New NotesSession
Set NAB = s.GetDatabase(<server name goes here>,"names.nsf")
Set peopleView = NAB.GetView("($VIMPeople)")
Set personDoc = peopleView.GetFirstDocument
Do Until personDoc Is Nothing
If personDoc.GetItemValue("MailSystem") = "Notes" Then
userName = personDoc.GetItemValue("FullName")(0)
mailServerName = personDoc.GetItemValue("MailServer")(0)
mailDbFilepath = personDoc.GetItemValue("MailFile")(0)
Set mailDb = s.GetDatabase(mailServerName,mailDbFilepath)
If Not (mailDb Is Nothing) Then
isUserListed = False
Set acl = mailDb.ACL
Set aclEntry = acl.GetFirstEntry
Do Until aclEntry Is Nothing
If aclEntry.Name = userName Then
If aclEntry.Level > 0 Then
'User has not been specifically denied access by name
'(may be part of termination process)
'Make access level Editor
aclEntry.Level = 4
End If
isUserListed = True
Exit Do
End If
Loop
If Not isUserListed Then
'User was not listed in mail db ACL
Set aclEntry = acl.CreateACLEntry(userName,4)
'Sets the user to Editor to avoid future ACL problems
aclEntry.IsPerson = True
End If
Call acl.Save
Else
Messagebox("Mail database not found for " & userName & ".",48,"Agent Error")
End If
End If
Set personDoc = peopleView.GetNextDocument(personDoc)
Loop
End Sub
You’ll need the Designer client to create a LotusScript agent. Where you store the agent is pretty much up to you – it doesn’t need to be in any particular database, as long as it is able to connect to all of your mail servers and you are allowed to create and run LotusScript agents in the host database. It can be set to run manually or on schedule with a target of “All documents in database” or “None”.
For , just enter the name of any server that has a complete replica of the Domino Directory for your domain. If you really, really want to give your users Manager access to their mail databases, you can change this line:
Set aclEntry = acl.CreateACLEntry(userName,4)
to read:
Set aclEntry = acl.CreateACLEntry(userName,6)
and kill the If segment that sniffs the aclEntry.Level.
Subject: Thanks!
I’ll keep this script around in case I need to run thru the ACLs again in the future. I’m still quite green at LotusScript programming, and will definitely want to experiment on a test server first.
I was able to fix all my user mailfiles ACLs by using the OpenNTF’s “ACLHelp” utility along with some editing tricks to create a big batch file to run ACLHelp on every user.
I first made a custom view of the names.nsf to get a two-column text list of the mailfile names and full user names, then used “awk” upon that file to create a giant batch file full of ‘nserver -c “load aclhelp mail\filename.nsf -editor -privateviews -sharedviews Firstname Lastname/DOMAIN”’ commands, then used Domino Administrator to perform a mass cut-n-paste of a set of securely chosen minimalistic ACLs without any owners to stomp on all mailfiles on the server. When that completed in a couple minutes, I then ran my batch file to re-add all the owner ACLs back to their own mailfiles, actually as Editors, not Managers, and now have a uniform set of proper and secure ACLs on each and every mailfile. Once the plan was developed and debugged, the whole process took less than ten minutes to run and essentially regenerate the entire ACL sets for all users in the server. I actually ran it on a second cluster member server that contained replicas of everyones mailfile, so that not one user was disrupted during the process, then replicated the changes over to the main server. The users never noticed a thing during the execution. I sure didn’t want to run for more than one day with “default” being “manager” on a large number of mailfiles, while coming up with a solution to the problem of missing owners in the ACLs.
Subject: RE: Thanks!
That’s one helluva work-around, Neal. Congratulations!