Reference Guide › Configuration File Reference › WITHHOLD Record

WITHHOLD Record

Use the WITHHOLD record to restrict users from using CA VM:Director commands, utilities, or screen selections. WITHHOLD records are also used to define exceptions to general authorizations given by GRANT records.

For CA VM:Director, the WITHHOLD record has this syntax:

WITHHOLD authority [OVER target‑userid(s)] FROM users

Configuration File

ACCESS is defined in the PRODUCT CONFIG file.

Definitions

authority

Specifies the authorization being withheld from an entire command, a command and some of its parameters, or a list of commands; authority can be any of the authorizations in the following tables:

• Any command or utility authorization, User Selection Menu (USE command) authorization, or Manager Selection Menu (MANAGE command) authorization from the Authorizations to Use CA VM:Director Commands and Utilities table in the Administration Guide
• Any predefined variable list from the Predefined Variable Lists table in the Administration Guide
• Any command processing authorization from the Authorizations for Command Processing table in the Administration Guide
• Any lists you create using LIST records

Note: For information about how to use lists, see User ID Lists and Authority Lists in the chapter "Authorizations" in the Administration Guide. For more information about LIST record, see LIST Record.

You can also use an authorization with a trailing asterisk (for example, MAN*) to indicate all authorizations that begin with the specified characters. Such authorizations will be flagged by the configuration file editor as unrecognized, but they are still functional.

OVER

Limits the scope of the authority; you can use the word OVER, to make it clear that the authority is invalid for user ID(s) that follow the word OVER.

target‑userid(s)

Specifies the user ID(s), over which the authority cannot be exercised by users.

users

Consists of a list of user IDs, separated by blanks, that are restricted from receiving authorization. A trailing asterisk (for example, M*) indicates that all user IDs beginning with the specified characters are denied authorization.

Examples

• Prevent any user ID from being assigned to manager KEVIN:

  WITHHOLD ASSIGN * KEVIN FROM *ALL
  

• Prevent any use of the COMPRESS command on any extent of the volume DOSRES:

  WITHHOLD COMPRESS DOSRES FROM *ALL
  

• Prevent user BISHOP from issuing the PASSWORD command:

  WITHHOLD PASSWORD FROM BISHOP
  

• Prevent your administrators, BRENDA, SALLY, and ROB from issuing the MDSKSCAN command:

  LIST *ADMINS BRENDA SALLY ROB
  WITHHOLD MDSKSCAN FROM *ADMINS
  

• Prevent DAVID from issuing the PASSWORD command for any users that are managed by user MAINT.

  WITHHOLD PASSWORD OVER *DIRUSRS OF MAINT FROM DAVID