HCL Domino Ideas Portal

Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.

For more information and upcoming events around #dominoforever, please visit our Destination Domino Page

Add a new idea Subscribe
Status No Plans to Implement
Workspace Notes
Created by Guest
Created on Mar 21, 2024

RELATED IDEAS

Change the specification for "Deny Access Groups" in DLAU

In DLAU (Domino License Analysis Utility),the following message is appeared in "Environment Observations" after Scan was executed.

"The HCL Domino server "<server name>" is not using any Deny Access Groups to secure server access"

This is output when the "Deny Access Groups" document does not exist in the Domino directory.

Even with the current operating specifications, for some reason, it is necessary to create "Deny Access Groups" document in Domino Directory even if there are no users to register in the "Deny Access Groups".

However, it will only confuse the customer if there are no inaccessible users and the error against the inaccessible group goes out of its way to output a message for that error.

If there are no inaccessible users in the environment and customer needs to clear the security observations, please change the specification in the future so that the "Deny Access Groups" document is not created and the error is not output.


  • Attach files
  • Guest
    Reply
    |     Mar 25, 2024

    "Simply creating a Deny Access Group having no members in the first place and edit/update the servers document(s) accordingly should fix that."

    Wouldn't it be user-friendly to not bother to perform such an action?

    Even removing retired users from the Domino directory is a natural security action. It is no wonder that some customers have such a policy.

    I don't understand why you don't support that. Please reconsider to implement.

  • Admin
    Thomas Hampel
    Reply
    |     Mar 25, 2024

    Correct. The recommendation is to have a deny access group in place. Even if it is empty or not used. Closing this idea with "No plans to implement"

  • Guest
    Reply
    |     Mar 22, 2024

    Simply creating a Deny Access Group having no members in the first place and edit/update the servers document(s) accordingly should fix that.

    In case you have persons who left the company whose person documents you don't want to delete immediately but weeks later, you just add those persons to the Deny Access Group.

    (For security reasons it generally makes sense to add former users to the Deny Access Group. Might be a topic for itself.)

Copyright © 2023 HCL Technologies Limited