Command Functions › DEADMIN Function—Remove Administrative Authority

DEADMIN Function—Remove Administrative Authority

Valid on z/OS, z/VSE, and z/VM.

Use the DEADMIN command function to revoke administrative capabilities from subordinate CA Top Secret administrators.

Administrative authority:

• Cannot be assigned to zones, division, department, or profile ACIDs.
• Can only be assigned to subordinate administrators within the administrator's scope. For example, VCAs cannot assign administrative authorities to other VCAs, even if they are in the same division. VCAs can assign administrative authorities to DCAs, User ACIDs, and auditors within the divisions they control
• Only the MSCA defined to CA Top Secret during installation can create and assign administrative authorities to SCAs.
• Can only be deadministered for authorities the command issuer already controls.

For information on the format, rules, and restrictions that apply to the DEADMIN function, see the ADMIN command function.

Examples: DEADMIN command function

This example removes VCA1's authority to assign the AUDIT attribute for DSNAMEs:

TSS DEADMIN(VCA1) DSNAME(AUDIT)

VCA1 still has the authority to assign ownership of DSNAMEs to ACIDs within his scope.

This example totally removes VCA1's authority for DSNAMEs:

TSS DEADMIN(VCA1) DSNAME(ALL)