August 24, 2026
Keeping track of IBM i configurations and how users are using IBM i is important for security purposes. But administrators and analysts are already so overburdened with other responsibilities that it is easy to let something slip by. That is why IBM is building new SQL capabilities into Access Client Solutions, which hopefully will make it easier for IBM i shops to spot potentially damaging configs or uses before they hurt the organization.
ACS is one of the most important tools provided by IBM for IBM i professionals, as it contains a slew of facilities for interacting with the system. It includes an emulator, spool file and IFS viewers, tools for data transfer, and a virtual console for LAN and HMC management. And of course it also contains Run SQL Scripts, a console for not only running SQL on the system, but also developing it.
IBM has developed hundreds of IBM i Services over the past few years that provide SQL versions of IBM i system commands or Control Language (CL) equivalents. These IBM i Services handle a wide range of tasks on IBM i, including security tasks.
As we mentioned in our July 20 story Big Blue Finally Unveils First IBM i Tech Refreshes Of 2026, as part of the 2026 summer Technology Refresh (TR) for IBM i 7.6 TR2 and 7.5 TR8, IBM has added several new security-focused IBM i services to the “Insert from Example” library in the Run SQL Scripts component of ACS. These SQL examples help admins and analysts answer important security questions, such as:
- Who is creating objects in the IFS root?
- Who is creating objects in the /QOpenSys subdirectory
- What IFS first-level directories are open to attack?
- What are the IFS subdirectory object attack vectors?
- And what does the IFS home directory ownership look like?
Scott Forstie, the Db2 for i database architect, is the biggest cheerleader on the planet for SQL on the IBM i, and so it’s no surprise to see that he is a big proponent of using SQL to improve the manageability of IBM i, as well as improving security. Forstie talked about some of the new security capabilities in a recent IBM i Guided Tour.
The Run SQL Services facility within ACS can be used to easily spot unused but active user profiles, which pose a security risk.
During his demo, Forstie used SQL in ACS to find user profiles that haven’t been used in the past three months. The results of the query not only showed the user names, but also included columns that included labels, which can include additional information that might be important, Forstie said.
“If you’re like me, then the label can be very useful in some cases,” Forstie said. “In this particular query we didn’t need it, but I’d like to have it around all the time because that extra context will help me.”
The query result showed null values for many user names, which meant that they had never been used. Some of those were disabled, but some were also enabled, which could potentially pose a security threat (or at the very least, ding you on a security compliance check). “It’s easy for us now to go through,” Forstie said. “Lots of admin stuff going on here.”
The new TRs also bring support for a new capability in SYSTOOLS that allows the user to easily generate a spreadsheet from an Insert From Example and send it via email. To use this function, users must have “save results” enabled on their ACS. However, that feature is not enabled by default as ACS ships from the factory, as it causes the queries to run just a little bit slower.
“If you’re wondering why we don’t just check it on for every user–oh, boy, we had a good debate about that,” Forstie said. “When you have enable ‘saving of results’ checked, we use a different type of scroll cursor so that we are able to save the results for the entire part of the query. So that means it can run a little bit slower. So if you never, ever, ever want to save the results in spreadsheet okay, fine. Uncheck it and your performance will improve a little bit. For everybody else, just use it.”
Users don’t have to explore their security and configuration settings through ACS. They can use traditional green screen tools, commands, and CL. But Forstie made a good case that things are just easier, nicer, and better when using ACS.
For instance, in Run SQL Scripts, the user can use the Shift-F11 key to toggle between names and system names. “Typically the long SQL names are going to be easier to understand, but maybe you’re working with code where the style is to use the system names,” he said. “So then you can have a good experience for yourself, but then also code to the things that is consistent within and across your infrastructure.”
Color coding is another feature in ACS that makes things easier on user eyeballs. With Run SQL Scripts, users can use SQL as well as CL, and the IDE (Forstie considers it to be the best IDE for SQL development on IBM i) will automatically switch colors between the SQL and the CL code.
Another use of Run SQL Scripts in ACS: identifying library ownership. What is ‘CWOODBURY’ doing here?
Forstie is also a big fan of the help text in Run SQL Scripts. “This help text is just amazing,” he said. “It’s all HTML, rich alt text, so it actually helps in a way that’s nicer for the user, because this is a lot easier to read than a little periscope on a 5250 screen, I believe. And it’s actionable.”
Another fun fact for Run SQL Script: It normalizes query results to comply with user settings. In Forstie’s example from the IBM i Guide Tour, the results of a “compare display object description” query using the CL version returns some funky, hard-to-read data, including century codes. Not the SQL version, though.
“But if we look at the sunny side of the ledger, the SQL side, let’s do the same thing,” Forstie said. “We did the same thing in the CL command, it must be the same output right? No. Object statistics is normalized by your friends in the database…It’s all normalized and ready for consumption.
“This particular UDTF [user-defined table function] should be your discovery engine for anything in any libraries, or objects in libraries, and you can use ACS to refine and find the things you really need,” Forstie continued. “Like if you want to find the largest things, the things that are the least used, the things that are not secured. There’s all kinds of use cases and they’re right at your fingertips.”
For instance, Forstie’s demo showed that the owner of some objects is some person named “Carol Woodbury.” That’s a system admin’s worst nightmare, and ACS makes it easier to find and remediate.
“Beep, beep, beep, sound the security alarm,” Forstie said. “Scott should be the owner of the things in Scott’s cool stuff library, I think. So we can make adjustments now that we have this great insight.”
All told, the power of SQL combined with the usability of ACS and the Run SQL Scripts facility give users a tremendous amount of freedom to explore a range of IBM i configuration settings, including those important for security.
“It’s easy for me to bounce about,” Forstie said. “That’s what happens when you start using SQL services. You’re going to make discoveries and you’re just going to be a hero because it became easy.”
You can see the list of all updates to ACS here.