How ECLs respond to changes in the Notes/Domino environment

02 Things you need to know

Administrator Client, Client, Server
How ECLs respond to changes in the Notes/Domino environment

Execution Control Lists (ECLs) were introduced in Notes/Domino versions 4.5. You use an ECL to set up workstation data security. An ECL limits the actions of formulas and scripts when they run on a workstation. For example, an ECL can prevent another person's code from running on a computer and damaging or erasing data. As the administrator, you can allow users to modify their ECL, or you can control changes to the ECL.

In versions of 5.0.2 and later of Domino/Notes, the client default ECL settings were changed to help strengthen the security that ECLs offer. If you're planning to upgrade clients from version 4.5 or later to versions 5.0.2 or later, or if you're just planning to install a new client, the table below should help clarify how ECLs respond to changes in the Notes/Domino environment.

Notes:

In the table below, the "Results when there is no Admin ECL" applies under either of the following two circumstances:
For a list of client default ECL settings by version of Notes and Domino, see the table titled "Client default ECL settings" at the end of this Release Note.

Action	Results when there is no Admin ECL	Results when there is a home server with an Admin ECL
"Allow user to modify" button is not selected in the Admin ECL, and the workstation ECL is being updated via an install or refresh.	Not applicable	The workstation ECL is updated with the server's Admin ECL.
Install a new client	ECL defaults are assigned based on version of the client that you install. The user's name is automatically added to the ECL if there was no ECL in the user's desktop.	The server's Admin ECL overwrites the client default ECL`.` The resulting ECL has entries from the client default ECL in addition to new entries from the server Admin ECL. The privileges in the Admin ECL overwrite the privileges of the same entry in the client default ECL. The user's name is automatically entered in the ECL because there is no existing workstation ECL. For a list of client default ECL settings by version of Notes and Domino, see the table titled "Client default ECL settings" at the end of this release note.
View server Admin ECL	If the server is available, you see the client's default settings. However, if the server isn't available, you can't view the server Admin ECL.	You see the server Admin ECL.
Upgrade any client version 4.5 or later to a newer version of the client where a workstation ECL already exists in the desktop and the ECLSetup NOTES.INI setting is unchanged and set to its default, 3.	The workstation ECL maintains its original settings from before it was upgraded.	The workstation ECL maintains its original settings from before it was upgraded.
Upgrade a client running a version prior to 4.5 and having no desktop (or ECL) to version 4.5 or higher`.` -or- Start a client running version 4.5 or later with no desktop	The workstation ECL takes on the default workstation ECL settings. The user's name is automatically added to the ECL.	The server's Admin ECL overwrites the client default ECL`.` The resulting ECL has entries from the client default ECL in addition to new entries from the server Admin ECL. The privileges in the Admin ECL overwrite the privileges of the same entry in the client default ECL. The user's name is automatically entered in the ECL because there is no existing workstation ECL. For a list of client default ECL settings by version of Notes and Domino, see the table titled "Client default ECL settings" at the end of this release note.
Upgrade a client from and to a version after 4.5 where the NOTES.INI setting for ECLSetup is less than the target client default of 3, or ECLSetup does not appear in the NOTES.INI file. -or- Start a client version 4.5 or later where the NOTES.INI setting for ECLSetup is less than the target client default of 3, or ECLSetup does not appear in the NOTES.INI file.	The client default ECL overwrites the current workstation ECL. The resulting workstation ECL contains entries from the default settings that were not already in the existing workstation ECL. In addition, if there's an entry that appears in both the default workstation ECL and the existing workstation ECL, the privileges in the client default ECL overwrite the privileges of the same entry in the existing workstation ECL.	The server's Admin ECL overwrites the current workstation ECL. The resulting workstation ECL contains entries from the Admin ECL that were not already in the existing workstation ECL. The privileges in the Admin ECL overwrite the privileges of the same entry in the existing workstation ECL.

NOTE: This table concentrates on the workstation ECL, but the principles are the same for the Java and Javascript ECLs.

Client ECL settings: Default entries

When you first install a client, its ECL settings include some preset entries in the "When signed by" field:

Version Defaults

4.5.x, 4.6.x
- No Signature -
- Default -
Note template (with all privileges)
The user's name is automatically added to the ECL if there was no ECL in the user's desktop.

5.0.2
- No Signature -
- Default - (with no access)
Note template (with all privileges)
The user's name is automatically added to the ECL if there was no ECL in the user's desktop.

5.0.3
- No Signature -
- Default - (with no access)
Note template (with all privileges, special trustworthy entries)
The user's name is automatically added to the ECL if there was no ECL in the user's desktop.
As of 5.0.3 the trustworthy entries are Binary Tree, Sametime, and Fax for Domino, which are assigned the set of accesses they need, determined on a case by case basis.

Examples:

An existing enterprise has clients and servers currently running several versions of Notes and Domino, from version 4.5 to version 5.0.1. Upgrading all existing servers, all existing clients, or all existing clients or servers to version 5.0.2 will not automatically enforce the new ECL settings on any of the existing clients.
In the same enterprise, installing a new 5.0.2 client will enforce the new ECL settings regardless of the version of the Domino server, as long as the server doesn't have a customized Admin ECL.

Version	Defaults
4.5.x, 4.6.x	- No Signature - - Default - Note template (with all privileges) The user's name is automatically added to the ECL if there was no ECL in the user's desktop.
5.0.2	- No Signature - - Default - (with no access) Note template (with all privileges) The user's name is automatically added to the ECL if there was no ECL in the user's desktop.
5.0.3	- No Signature - - Default - (with no access) Note template (with all privileges, special trustworthy entries) The user's name is automatically added to the ECL if there was no ECL in the user's desktop. As of 5.0.3 the trustworthy entries are Binary Tree, Sametime, and Fax for Domino, which are assigned the set of accesses they need, determined on a case by case basis.