GroupWise Auditing and Administering

Auditing your GroupWise installation requires knowing how the accounts are defined and being used. When auditing GroupWise, the following are of particular value:

• Proxy access assignments
• Disk space in-use, threshold and number of messages
• Date of last account login
• Accounts that have no password assigned

The first three of these details can be discovered by using GWCHECK. The fourth, Accounts that have no password assigned, is unique to DSRAZOR for GroupWise.

Refining GWCHECK's output

Inspection of your GroupWise installation is enabled by the GWCHECK utility that is included by default with GroupWise. With this tool you can perform many important functions. You may already be familiar with it and its use.

An important function provided by GWCHECK is its ability to report the details of all accounts including proxy access assignments, disk space in-use, number of messages, and date of last account access/login of each.

Due to the comprehensive "all or nothing" nature of GWCHECK's reporting, its report output for 200 GroupWise accounts can easily run in excess of 100 megabytes! This output size is attributed to the inclusion of all varieties of account activity. For an account that has been in-use for a while the output can easily exceed 1MB of data. The result is complex and cumbersome data that is not readily usable.

Imagine viewing and using an unformatted GWCHECK report in excess of 100 megabytes, it can be very challenging. The abundance of data and its formatting as generated by GWCHECK can essentially render its manual processing useless.

Proxy access assignments

GroupWise's proxy access assignments provide the ability to grant specific rights between different accounts. These assignments include:

• READ: Mail/Phone
• WRITE: Mail/Phone
• READ: Appointments
• WRITE: Appointments
• READ: Reminder Notes
• WRITE: Reminder Notes
• READ: Tasks
• WRITE: Tasks
• SUBSCRIBE to my alarms
• SUBSCRIBE to my notifications
• MODIFY options/rules/folders
• READ items marked private

There are two primary methods to obtaining GroupWise proxy access assignments. The first is to login to each account and manually check the proxy access assignments; this method requires knowledge of the account password. The second is to use GWCHECK to create a report.

The data format of GWCHECK's output regarding proxy access assignments is difficult to use for two reasons, (1) it is intermixed with other output regarding the particular account which means you must examine the entire output for each account, as mentioned earlier this can easily exceed 1MB per account; (2) the proxy access assignment data is confusing due to the use of numbers to represent access privilege values, in preceding example the access privileges are described by numeric values.

When you use DSRAZOR for GroupWise, the output is formatted to be more user friendly. The output can have rules set that can help you quickly identify those accounts that contain specific access assignments such as those that allow writing to other accounts.

Disk space in-use, threshold and number of messages

The details regarding disk space in-use, disk space threshold and number of messages in the INBOX, OUTBOX and WASTEBASKET are revealed by GWCHECK. the "User stats" line does not indicate the user/account name being detailed. This name is revealed once, at the top of the particular account's listing which requires "backing up" through 1MB or more of data to obtain. Therefore, manually connecting the GWCHECK report output user/account name to its disk space data can be a daunting challenge.

When you use DSRAZOR for GroupWise, the output is formatted to be more user friendly. Each of the columns can be sorted and rules can be applied to report just those accounts of interest whether they be using excessive amounts of disk space with no threshold set or simply have a very high number of "trash" messages.

Date of last account login

Determining the last date of activity of your GroupWise accounts requires GroupWise 6.0 or later, earlier versions do not provide this functionality. To view the last date of activity, use the Audit Report option within GWCHECK.

DSRAZOR for GroupWise will extract the last date of activity for each of your GroupWise accounts by automatically running GWCHECK. In addition to providing a more user-friendly view of the last date of activity, for instance, making the last activity date sortable, each account displayed can be acted upon. For instance, the account can be deleted or you can reset its password. This ability to take action directly from the report is one of the most powerful features of DSRAZOR for GroupWise.

Accounts that have no password assigned

Within GroupWise there is no setting that requires each account to have a password. And, because the GroupWise account password is not inextricably linked to any other agent (such as eDirectory, Active Directory and so on), it is entirely possible for accounts to have no password and for you to not know it.

GroupWise accounts that do not have a password can result in unintended security consequences. DSRAZOR for GroupWise provides you with the ability to scan and test each account to find those that do not have a password. You decide the action to take regarding those accounts with no password. For instance, from the same report that reveals such accounts you can immediately assign a password.

Incorporating DSRAZOR for GroupWise into your GroupWise toolset will complement your ability to successfully audit your GroupWise installation.

The next section will discuss the GroupWise management abilities provided by DSRAZOR for GroupWise.

Everyday management of GroupWise accounts often involves use of tools such as ConsoleOne or NWAdmin. These all-encompassing interfaces provide access to abilities beyond those required for routine maintenance. Additionally, these interfaces contain a large amount of functionality that cannot be isolated to only those actions required for routine GroupWise maintenance.

For purposes here, we define routine maintenance of GroupWise as including:

• Creation of Accounts
• Deletion of Accounts
• Changing of Passwords
• Managing Distribution Lists

DSRAZOR for GroupWise's interface reduces the reliance upon ConsoleOne and NWAdmin when performing routine GroupWise maintenance. The DSRAZOR for GroupWise patented interface allows for the creation of job-specific applets that perform only those functions you select. This has the dual purpose of increasing your ability to delegate GroupWise management to others while increasing security since only the actions you preauthorize will be allowed.

The following sections further detail how DSRAZOR for GroupWise will help you quickly and securely perform routine GroupWise account maintenance.

Creation of Accounts

With DSRAZOR for GroupWise creating GroupWise accounts can be accomplished by three different approaches:

• New - direct
• When directly adding new GroupWise accounts you are creating the account without associating it with any other entity such as an existing eDirectory account.
• New - import
• When importing new GroupWise accounts, you are importing the account from some type of script file, perhaps a CSV file.
• While importing new GroupWise accounts, you can use DSRAZOR for GroupWise's random password generator to assign a unique password to each new account.
• Add to existing eDirectory account
• When adding new GroupWise accounts to an existing eDirectory account, you are associating the new GroupWise account with an existing eDirectory account.
• Adding new GroupWise accounts to existing eDirectory accounts can be done for multiple accounts at once.

Additionally, DSRAZOR for GroupWise can be used to establish or change Address Book Visibility for multiple GroupWise accounts.

Deletion of Accounts

With DSRAZOR for GroupWise deleting GroupWise accounts can be accomplished by two different approaches:

• By association with an eDirectory account
  • When deleting an eDirectory account you can also delete its associated GroupWise account and the complete Home Directory structure.
• By membership in a GroupWise Post Office
  • For GroupWise v6.0 and later Post Offices, the last activity or login date is available. The last activity date can be used to reveal old and/or unused accounts.

Changing of Passwords

With DSRAZOR for GroupWise changing GroupWise account passwords can be accomplished by two different approaches:

• GroupWise Account Only
  • When changing only the GroupWise account password, it will not automatically synchronize with any other accounts.
• GroupWise and eDirectory Account
  • Change both the GroupWise and eDirectory account password with a single click.

Managing Distribution Lists

With DSRAZOR for GroupWise managing GroupWise Distribution Lists can be accomplished by two different approaches:

• Account
  • View Distribution List membership and participation type for each GroupWise account.
  • Discover GroupWise accounts that do not belong to any Distribution List. This ability is unique to DSRAZOR for GroupWise. Use this ability to ensure each account belongs to at least one Distribution List. This approach provides the ability to view and document Distribution List membership.
• Distribution List
  • View membership per Distribution List including the participation type.
  • Add GroupWise accounts to Distribution List membership.
  • Remove GroupWise accounts from Distribution List membership.
  • This approach provides the ability to modify Distribution List membership as well as document membership.