Managing Group profiles

1. OS/400 provides the Group Profile and Supplemental Group
Profile parameters on the user profile setup. The Group Profile is the user's primary group that their work will be associated with.
The Supplemental Group Profile lets you also associate the user with up to 15 additional groups other than the primary group.

2. Once the user's profile is set up this way, you no longer have to manage their individual user profile for granting security permission to use resources on your system. All you need to do then is manage the group profile setup. If you have 100 users on your system, but they can be broken down into five work groups,then all you need to worry about are the five group profiles. As you can see, this will greatly simplify the work needed for security administration.

3. To implement group profiles, you should first design your groups. You should take into account the type of work performed and the software applications that will be used by users in each group. Remember that you can also use Supplemental Group Profiles if there are gray areas where this will help you subdivide application controls.

4. Supplemental Group Profiles can also be used for those users, such a supervisors, who need access to multiple group resources on your system.
Note: You cannot implement Supplemental Group Profiles without first assigning a primary Group Profile to a user.

5. Once you have your groups designed, then go ahead and create a user profile for each group. Since these profiles will not actually be logging on, you can set the profiles up with the password set to the special value of *NONE. This way, users cannot sign on using the group profile itself.
I recommend that you create new profiles for groups and not use any existing groups, especially the IBM supplied Qxxxx profiles.With these Group Profiles created, you can now work on assigning your existing users to their respective groups. This is done from the WRKUSRPRF command or you can perform the updated individually using the CHGUSRPRF command and setting the GRPPRF parameter for the primary group and the SUPGRPPRF parameter for any supplemental groups that you want to use. Last, but definitely not least, you will have to update your object security to reference the new group profiles rather than individual profiles. When this is all setup, the only complication will be properly grouping new users as they are added to your system.
6. The setup can be complex, but the rewards in reduced security