Re: Preparing for a High-profile Termination

["Jim Franz" <franz400@xxxxxxxxxxxx>]

(hopefully not repeating what others said..)
I would (and have done this before) force all users to change their password 
as soon
as possible after terminate (a clp to expire the user profiles (don't update 
"Q", but
verify the "Q"'s as was earlier suggested.
Tell them the auditors insist (& say nothing about the termination).
Turn on object auditing, especially cmd's for everything this person does, 
starting now.
Have someone monitor thru wrkactjob his sessions to see if using
various profiles.
Get physical control of the latest backup prior to the decision made or even
thought of (because he may know as soon as was discussed).
Get physical control of last full system backup.
Don't assume backups are in the vault. If really paranoid - check a backup
really has what it is supposed to.
Stop overwriting recent backups.
Write a clp to take every user profile on the system, and for each
scan all source, looking for profiles embedded in the code.
Check control files and data areas for profiles & pwds.
List all objects on system to an outfile, daily, keeping all the files
from now to well after terminate & no problems.
At the exit/terminate interview - ask him (nicely) to reveal all profiles he 
knows -
all this is a prepare for worst case, and he may not have any intentions (at 
the interview or ever).
(If this is expected to be ugly, kicking & screaming, then check the web for 
how to "handle"
a termination like this. We don't need another shooter.
would suggest this be executed immediately if possible. Delays just mean 
more
opportunity for problems.
jim franz


> ____________________________________________________________________________________
> Fussy? Opinionated? Impossible to please? Perfect.  Join Yahoo!'s user 
> panel and lay it on us. 
> http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.