Duffbert's Random Musings

Document Number:  1136822

Problem

On the Domino R5 Server users can create personal agents in Notes databases.  However, it is possible for the Administrator to restrict the ability of these personal agents to run using the Agent Restrictions section of the Server document.  When the Server is upgraded to Domino 6.x, these personal agents are no longer restricted, and run unexpectedly.

Content
This behavior occurs because the Server document security settings work differently in Notes/Domino 6.x than in Notes/Domino 5.x.  In Notes/Domino 6.x if a user is granted rights in either of the Server document fields, "Run Unrestricted Methods and Operations" or "Run Restricted LotusScript/Java Agents", then the user is automatically granted permission to run personal Simple Action and Formula agents.

This issue was reported to Lotus Software Quality Engineering, and was fixed in the following Notes/Domino releases:    6.0.1 CF3, 6.0.2 CF2, 6.0.3 and 6.5.  

If the Administrator adds the parameter, Enforce_Personal_Agents=1 to the Domino Server's Notes.ini file, it reverts to the R5 behavior where the user must be granted permission within the Server document's "Run Simple and Formula agents" field.  If the INI parameter is instead set to 0 or the parameter is not included in the INI then the user will experience the Notes 6.x behavior.

Excerpt from the Lotus Notes and Domino Release 6.0.1 CF3, 6.0.2 CF2 and 6.0.3 MR fix lists (available at http://www.lotus.com/ldd):

Agents:

• SPR# SSHE5FNNBU - Added the new Notes.ini variable, ENFORCE_PERSONAL_AGENTS=1, which forces a user to be listed in the Personal Agents field in the Server document in order to be able to run personal agents.