Try this question <a href="http://itknowledgeexchange.techtarget.com/itanswers/as400-who-created-a-user-profile/">http://itknowledgeexchange.techtarget.com/itanswers/as400-who-created-a-user-profile/</a>
======================================================
<i>...both only show the user that created it but this could not be the TRUE user that created the profile.</i>
Although the statement from below is correct, it is usually irrelevant. Essentially every action is performed by a 'user' and every one may be initiated by some 'true user'.
The underlying principle simply must always be kept in mind during <i>any</i> forensic process. It is perhaps worth noting in discussion but might confuse the direct answer.
The direct answer is that the 'Created by user' attribute of the *USRPRF object is the user that created that *USRPRF.
Tom
======================================================
While hte solutions in the above link are the normal process, they have shortcomings.
both only show the user that created it but this could not be the TRUE user that created the profile.
Object Description o fthe profile in Question:
Creation date/time . . . . . . . . . : 03/29/10 13:45:55
Created by user . . . . . . . . . . : MISOPR
The best method is a two part one.
* Use the CPYAUDJRNE command as specified in the other answer.
* Once you find the correct entry, look for the job that created it.
Job User Job
name name number
QDFTJOBD MISOPR 982295
* Do a WRKJOB or DSPJOB on the job that created the profile in question.
* Display the joblog and look for something similar to this where that job was submitted from another job.
CPI1125 Information 00 03/29/10 13:45:55.528096
Message . . . . : Job 982295/MISOPR/QDFTJOBD submitted.
Cause . . . . . : Job 982295/MISOPR/QDFTJOBD submitted to job queue QBATCH in QGPL from job 982294/MISBXG/CONSOLEBG1.
* Note that the job that created the profile was submitted by another job from a different user name. So in this example, MISBXG was the user that actually created the profile.
This scenario may not always be the case and it is not to say that anything underhanded is being attempted, it's just that the process for creating profiles may be done via some sort of automation and possible from another system.
So don't take for granted that the 'created by' user is the actual culprit.
Last Wiki Answer Submitted: July 5, 2010 8:00 pm by Bggas400160 pts.
All Answer Wiki Contributors: Bggas400160 pts. ,
JimmyIT1,710 pts.
If you live outside the United States, by submitting your email address you consent to having your personal data transferred to and processed in the United States.
dspobjd *all/profile *usrprf – Select option 5 to display. This will show you who created it and on what date. You shouldn’t have any security issues displaying his.
dspobjd *all/profile *usrprf – Select option 5 to display. This will show you who created it and on what date. You shouldn’t have any security issues displaying his.
WRKUSRPRF option 5-Display
Display User Profile – Basic shows the following
Previous sign-on . . . . . . . . . . . . . :
Sign-on attempts not valid . . . . . . . . :
Status . . . . . . . . . . . . . . . . . . :
Date password last changed . . . . . . . . :
Password expiration interval . . . . . . . :
Set password to expired . . . . . . . . . :
Local password management . . . . . . . . :
User class . . . . . . . . . . . . . . . . :
Special authority . . . . . . . . . . . . :
Group profile . . . . . . . . . . . . . . :
Owner . . . . . . . . . . . . . . . . . . :
Group authority . . . . . . . . . . . . . :
Group authority type . . . . . . . . . . . :
Supplemental groups . . . . . . . . . . . :
Assistance level . . . . . . . . . . . . . :
Current library . . . . . . . . . . . . . :
Initial program . . . . . . . . . . . . . :
Library . . . . . . . . . . . . . . . . :
Initial menu . . . . . . . . . . . . . . . :
Library . . . . . . . . . . . . . . . . :
Limit capabilities . . . . . . . . . . . . :
Text . . . . . . . . . . . . . . . . . . . :
Display sign-on information . . . . . . . :
Limit device sessions . . . . . . . . . . :
Keyboard buffering . . . . . . . . . . . . :
Storage information:
Maximum storage allowed . . . . . . . . :
Storage used . . . . . . . . . . . . . . :
Storage used on independent ASP . . . . :
Try the following command and then press enter on the command line.
DSPOBJD OBJ(User ID) OBJTYPE(*USRPRF)
Then use option 5 = Display Full Attributes
Try this…
DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) OUTFILE(your library) *FIRST, *ADD
The syntax may not be 100 accurate, but once created query on the file created in the library you selected.
I just use WRKOBJ.