Gary, This is not a very constructive response but I thought I'd share the experience. That very problem is why we don't host Production QMgrs on Windows. We started looking into how to secure it and somewhere along the way we realized that the configurations necessary and the restrictions we placed on the local admin group were so far out of a standard build that it would be extremely difficult to replicate reliably across many servers. So for us the question was not whether the solution was possible but rather whether it was maintainable. From a technical perspective it looked possible (we abandoned the effort before this question was fully answered). >From a business perspective it just wasn't cost effective.
-- T.Rob -----Original Message----- From: Gary Ward [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 10, 2004 9:13 AM To: [EMAIL PROTECTED] Subject: Locking down MQ files/registry on Windows Folks, Any Windows gurus out there? I need to find a way to lock down the registry keys for MQ along with restricting access to the queue and log file systems. I've got a bunch of "maverick" admins that like to make direct changes to the registry when they need to change things in MQ. I plan to remove access to MQ Services so they can no longer make unauthorized changes there, but even with that available, they still prefer to go right to the registry!!! Unfortunately they need to be in the Administrators group in order to perform other necessary functions. Anybody have a creative idea? The other issue is protecting the qmgr and log directories from accidental deletion. This one is a toughie... Thanks in Advance! Gary Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com Archive: http://vm.akh-wien.ac.at/MQSeries.archive Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com Archive: http://vm.akh-wien.ac.at/MQSeries.archive
