LO47575: "LOGOUT (AND LOCK NOTES DISPLAY) IF YOU HAVEN'T USED NOTES FOR" CAN BE CHANGED IN NOTES.INI AFTER LOCKOUT

APAR status

• Closed as requirement.

Error description

• While troubleshooting the issue reported in SPR SDIO6RWDR2, I
  discovered
  another issue.  If the Admin sets the desktop settings policy to
  Lock the user
  ID after so many minutes of inactivity (let's say 15), the user
  can edit the
  notes.ini file and change the setting to another value.  The
  value will be
  reflected in the grayed-out setting "Logout (and lock Notes
  display) if you
  haven't used Notes for XX minutes" in the User Preferences, and
  it will be
  reflected in the same active preference in the User Security
  pane.
  
  Steps to reproduce:
  
  1. Create a Desktop setting document.
  2. Configure the Desktop policy setting "Lock ID after N minutes
  of
  inactivity:"to a number of minutes - 15 minutes
  3. Make sure that "Allow users to change the setting on this
  tab" is NOT
  checked i.e make sure the setting in the policy is locked
  down.
  4. Create a new Policy and assign it to a user x.
  5. Restart the client and switch to user x.
  6. Click File -  Preferences - User Preferences - Basic.
     "Logout(and lock Notes display) if you haven't used Notes
  for" is grayed-out.
  7. Click File -  Security - User Security - Security Basics.
     "Logout(and lock Notes display) if you haven't used Notes
  for" is not
  grayed-out (see SPR SDIO6RWDR2) and the setting is the same
  value in time
  8) Shut down Notes, edit the notes.ini file.  Locate the line
  AutoLogoffMinutes=15
  9) Change the paramater to another number, let's say 10.
  10) Restart Notes.  Check the setting in User Preferences, User
  security, both
  are now set to 10 minutes.  The Kicker is, the grayed out
  setting (the one that
  the user is supposed to be locked out of) is also changed.
  

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

• This APAR is associated with SPR# WTON7BDT6L.
  Part of batch rejection of resolved/closed sprs that are enh
   requests against v80.  If weight increases, may be considered
   for a future release.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels