Now let's look at the considerations to make prior to changing QCRTAUT.  First, it should go without saying that QCRTAUT should never be changed to *ALL.  However, it is appropriate to consider changing it to *USE or *EXCLUDE.  When I guide clients through the process of changing QCRTAUT, we start by getting a list of all of the libraries on the system and downloading it to a spreadsheet.  You can use Policy Minder to do this by creating a *LIBAUT template that includes all libraries.  (Don't bother creating an object template.)  Run a compliance check on this template then run the Output Compliance (OUTCPL) command from the SKYVIEWPMP library specifying STATUS(*ALL).  This will create a file in the /SkyView/Policy Minder directory which you can drag onto your desktop and open with Excel.

Once you have the spreadsheet, separate the libraries into four categories - IBM / IBM licensed product libraries, vendor product libraries, application libraries and user / developer libraries.  The next step is to determine whether the libraries' Create authority attribute can remain at *SYSVAL or whether it needs to be overridden with a specific value. 

You can typically leave the IBM libraries with their current settings. (You will see some with their Create authority attribute set to *SYSVAL and some overridden with a specific value such as *CHANGE.)  For the vendor libraries, we consider whether or not objects are being created into the libraries or whether the objects (programs, commands, files, etc) are just being utilized.  If it's the latter then we leave those library settings alone as well. If objects are being created into the libraries, then you have to consider whether the vendor product will continue to work correctly if the *PUBLIC authority of the newly created objects is set to *USE or *EXCLUDE.  If it won't run correctly, then you can consider changing those libraries' Create authority value to *CHANGE.

For the application libraries, you must consider whether the application's security scheme will support newly created objects with a *PUBLIC authority of *USE or *EXCLUDE.  If it won't, then you'll be forced into leaving those objects created with *PUBLIC *CHANGE.  To continue to have the objects created with *PUBLIC *CHANGE, set the Create authority attribute of those libraries to *CHANGE.    Personal or user libraries can typically be left at *SYSVAL because it is usually the individual user accessing the objects in his or her library and the *PUBLIC authority setting won't matter.