my experience is that it is better to create groups and give rights on groups. And they you insert the user in the groups you wanted to give rights.

this is the better method as give rights on user!

its your choice...

Yes, I agree that creating groups is the way to go.  We've got a few edge cases and legacy users though, and it's not particularly easy to see any individual access rights a user may have, across multiple servers and volumes.

If you only have nss volumes, you have 2 options after you created the new user via copy use:

- you create a security equivalence to the old user and do not remove the old user and instead set it to be unable to login;

- or you export all trustee rights with metamig ("/opt/novell/nss/sbin/metamig") and afterwards modify the resulting XML-files so that the new user gets the same rights as the old one and import those rights back with metamig. For this task you can create a script, but it is for sure a longer journey and totally depends on the number of users and volumes involved.

An easier solution is not available I think.

If you only have nss volumes, you have 2 options after you created the new user via copy use:

- you create a security equivalence to the old user and do not remove the old user and instead set it to be unable to login;

- or you export all trustee rights with metamig ("/opt/novell/nss/sbin/metamig") and afterwards modify the resulting XML-files so that the new user gets the same rights as the old one and import those rights back with metamig. For this task you can create a script, but it is for sure a longer journey and totally depends on the number of users and volumes involved.

An easier solution is not available I think.