Sometimes you run across a user profile and you see that it's being used, but you have no idea of its purpose. This article discusses how to discover a profile's use.
By Carol Woodbury
When helping clients remove profiles from their systems or reduce authorities assigned to profiles, I often face a situation in which the current administrator is uncertain whether a profile is being used and, if it is, what it's used for. The first time I was faced with the dilemma of determining a profile's use, I thought it would be easy. Simply enable object auditing of *ALL on the profile and see when it's being used, right? Wrong. Not all operations on all object types are audited. When I checked Appendix E of the IBM i Security Reference manual, I realized that the use of a user profile is not audited via object auditing.