#Admin
Posts tagged #Admin · 35 posts
- Domino Server Mail Rules: Catching Mail Before It Reaches the Inbox
Some messages you don't want landing in a user's inbox at all — block ones with a certain attachment, divert mail to a departed account, keep a copy of a category for the record. You don't need an agent for this: Domino's server mail rules apply while the message is still in MAIL.BOX, as the router handles it. This piece covers where you set them (the Configuration Settings document's Router/SMTP → Restrictions and Controls → Rules), when they run (as the message lands in MAIL.BOX, each message evaluated once — unlike the client-side rules in a user's mailbox), how conditions work (contains/is operators, no wildcards, AND/OR, case-insensitive), the six actions (Journal to keep a copy, Move to database to quarantine, Don't accept to reject outright, Don't deliver to silently delete or send an NDR, Change routing state to HOLD, Stop processing to skip later rules), and two things to know: Domino doesn't notify the sender or recipient by default, and mail rules are not an anti-virus solution.
2026.10.28 - Domino Out of Office: Why to Use the Service, Not the Agent
A user sets an out-of-office auto-reply, comes back and forgets to turn it off so the system keeps replying, or the replies always lag — which of these you get depends on which Out of Office type your server runs: Service or Agent. This piece covers how the two differ (the Service runs inside the mail router, so replies are instantaneous, failover is supported, delegation is integrated with calendar management, it disables itself when the period ends, and it allows periods shorter than a day; the Agent runs on a schedule four times a day by default, must be disabled manually, delegation isn't calendar-integrated, and its minimum period is a day), where you set it (the Server Configuration document's Router/SMTP → Advanced → Control, defaulting to Agent), why you should use the Service today, and two operations: seeing who's out via the Out of Office column on the Files tab, and listing mailboxes with an active Service via Tell router O.
2026.10.27 - Domino Cluster Failover: No Replica, No Failover
A Domino server goes down, or gets overloaded, and users barely notice — that's a cluster doing failover and workload balancing. But failover isn't magic: its hard prerequisite is that another cluster server holds a replica of the database — no replica, nothing to fail over to. This piece covers how the cluster components work together: each server's Cluster Manager probes the others for availability and load and finds membership by watching the Domino Directory's ClusterName; cldbdir.nsf (a replica on every server, one document per database and replica); the event-driven, near-real-time Cluster Replicator (checks about every 15 seconds, replicates only among cluster members, while the regular REPLICA task handles replication outside the cluster); how failover works (the Cluster Manager builds a list of servers holding a replica, sorts it by availability, and sends it to the Notes client, largely transparent to the user); how workload balancing uses an availability threshold to mark a server BUSY and route requests to other replicas; and the Internet Cluster Manager (ICM) for HTTP clients.
2026.10.26 - Policies: Push Settings to Every Notes Client From One Place
To apply one setting — a password rule, a mail quota, a desktop feature toggle, an ECL — to every Notes user at once instead of machine by machine, you use a policy. This piece explains how Domino policies work: the two assignment types (organizational policies apply automatically based on the OU used at registration; explicit policies are assigned by hand to individuals or groups); the policy settings document types (registration / desktop / mail / security / archive, plus the deprecated setup that merged into desktop); what the effective policy is — the settings a user actually gets, dynamically computed at execution time from OU-level, explicit (including groups), and inherited parent-policy values; the crucial How to Apply modes (Don't set value / Set initial value / Set value whenever modified / Set value and prevent changes = locked), which decide whether users can change a value; and how an exception policy lets specific users override otherwise-mandatory settings.
2026.10.25 - DDM: Domino's Built-in Proactive Monitoring
Server trouble is usually 'the users complain first, then you find out.' DDM (Domino Domain Monitoring) is Domino's built-in, proactive-leaning monitoring: it runs probes on a schedule to check the health of databases, the directory, messaging, the operating system, replication, security, the server, and the web, records events into ddm.nsf, and gives you a top-down, feature-oriented view of the whole domain in the Domino Administrator — often with a probable cause and suggested corrective actions. This piece covers what a probe is (and that its configuration documents live in EVENTS4.NSF and take effect immediately), how ddm.nsf stores events, how the collection hierarchy lets one collection server consolidate the whole domain (the collection interval is a fixed 5 minutes), the difference between enhanced and simple events, and how an event handler notifies you — by logging, mail, running an agent, running a program, sending console commands, or an SNMP trap — when an event fires.
2026.10.24 - How Domino Web Login and Multi-Server SSO Work
A user logs into Domino in a browser and then clicks around without logging in again — that's session-based authentication: the server issues a token, puts it in a cookie, and the browser carries it on every request. Letting a user log into one server and reach several others (SSO) relies on a Web SSO Configuration document in the Domino Directory holding a shared secret key. This piece covers how basic and session authentication differ, single-server cookies vs multi-server SSO, that the Web SSO Configuration document must replicate to every participating server, the hard conditions that make SSO fail (the DNS domain must start with a period, URLs must use the FQDN, cookies can't cross TCP/IP domains, only Domino servers can be listed, and all SSO servers must use the same Internet-access method), an easy trap — enabling Internet Sites in the Server document automatically disables an existing SSO configuration — and the caveats for sharing LTPA with WebSphere (importing WebSphere keys removes the idle-timeout option, and the LTPA realm must match).
2026.10.23 - Where Domino Reads Its Web Config: Internet Sites or the Server Document
You change a Domino web setting and nothing happens — often it's not a wrong value, it's the wrong place: Domino's Internet-protocol configuration comes from two sources, the older Server document (Web Server Configurations / virtual servers) and the newer Internet Site documents (stored in the Domino Directory and managed centrally). Which one a server reads is decided by one switch on the Server document's Basics tab. This piece covers how the two models switch, which protocols an Internet Site document configures (Web/IMAP/POP3/SMTP Inbound/LDAP/IIOP), why edits don't need a restart, an easy-to-hit all-or-nothing rule (if one protocol on a server uses Internet Sites, all protocols must), what the Web Site document's Basics/Configuration/Domino Web Engine/Security tabs each control, which settings (TCP/IP port, SSL port, server access) always stay in the Server document, and how to confirm from the HTTP startup message which source the server is actually using.
2026.10.22 - Why Your Scheduled Agent Doesn't Run — or Runs Late
You schedule an agent to run hourly, and it doesn't run, runs late, or gets killed mid-run — usually it's not the agent that's broken, it's the Agent Manager (AMgr) server task's settings governing it. This piece covers how AMgr schedules: the Server document's daytime/nighttime windows (default day 8AM–8PM, night 8PM–8AM) and the most common trap — if the two periods leave a gap, AMgr doesn't run scheduled agents during it; Max concurrent agents (1–10, default day 1 / night 2) and Max LotusScript/Java execution time (default day 10 min, night 15 min — over it, the agent is terminated and logged in the Agent Log); why document/mail triggers aren't instant (AMgr_DocUpdateEventDelay, AMgr_DocUpdateAgentMinInterval default 30 min, and other notes.ini throttles); what 'Agent scheduling is paused' means; and using Tell Amgr Schedule / Tell Amgr Status from the console to see whether it was even scheduled. Ends with a step-by-step checklist for a scheduled agent that won't run.
2026.10.21 - How a Message Routes Through Domino: It All Goes Through mail.box
A user clicks Send — where does the message actually go? In Domino, every message first lands in a database called mail.box, and the Router task reads the recipients one by one and decides 'deliver locally' or 'transfer to the next server.' This piece lays out the chain: what mail.box is (and why one server can run several mail1.box/mail2.box), how the Router periodically checks it and consults its routing table, the two transfer protocols (default Notes routing / NRPC moving the message hop-by-hop into the next server's mail.box, and SMTP using DNS MX, port 25, MIME only, off by default and enabled on the Router/SMTP tab of the Configuration Settings document), how the message is delivered into the recipient's home-server mail file; and finally the two kinds of message stuck in mail.box — dead (stop-sign: can be neither delivered nor returned to the sender) and held (red exclamation: held by a mail rule or quota) — what causes each and how to handle them.
2026.10.20 - Hiding a Database Design: Lock It Before You Ship a Template
You hand a template to a customer or install it on their server, and you don't want anyone seeing or changing the forms, formulas, and LotusScript inside — that's what hiding a database design does. Once set, in HCL's words it 'disables all design operations and hides all formulas and scripts': View > Design disappears, forms/views/agents can't be viewed or changed, formulas and code are invisible, and the design can't even be copied. This piece covers how it's done (via Replace Design with 'Hide formulas and LotusScript,' or inheriting from a template whose design is hidden), what it disables, why it isn't an encryption lock (it's not a permanent barrier to Designer/Manager users — pair it with the ACL), the point with no way back — there is no 'unhide,' so you must keep an unhidden copy of the template — and how hiding blocks agent changes, so use @Command[AgentEnableDisable].
2026.10.19 - Template Inheritance: Why Your Design Changes Get Overwritten Overnight
You change a form in a production database, and the next morning the change is gone — because that database has 'Inherit design from template' set, and the server's Designer task overwrote it overnight from the master template. This piece explains how Domino template inheritance actually works: what a master template is (an NTF with 'Database is a template'), how a database links to one via the Design tab's 'Inherit design from template,' how the design flows down through the server's Designer task (load design, runs daily at 1 AM by default, needs a replica of the template on each server), the difference between Refresh Design and Replace Design, and how to protect elements with 'Prohibit design refresh or replace' plus 'Propagate' — plus the practical traps: private agents/folders can't live in a template, and the icon/About/Using documents don't inherit by default.
2026.10.18 - NIFNSF: Move View Indexes Out of the NSF
An NSF bloats from two things: attachments (DAOS moves those out) and view indexes. NIFNSF (moving view indexes out of databases) handles the second — it moves a database's view indexes out of the .nsf into separate .ndx files, making the NSF smaller and backup/restore faster (an .ndx can grow to 1 TB). This piece covers what it does, why — like DAOS — it must have transaction logging enabled first, the ODS 51+ requirement, how to configure it on the Server document's NIFNSF tab in 12.0.2+ (versus the older notes.ini NIFNSFEnable / NIFBasePath / CREATE_NIFNSF_DATABASES), how to enable it per database with load compact -c -nifnsf on, and how to check with show dir -nifnsf — plus why enabling it with -c brings us right back to the DBIID rule.
2026.10.17 - DBMT: One Command Replaces Nightly compact, updall, and fixup
The maintenance-commands piece walks you through compact, updall, and fixup one at a time; but nobody types those by hand at 2 AM in production — the old way was a pile of Program documents running updall nightly plus a separate compact. From Domino 9, dbmt (the database maintenance tool) folds them into one: HCL says it 'relieves the administrator of the need to run the Updall task,' doing compact + updall + (when needed) fixup in a single task, with thread counts, a time window, and a compact-every-n-days cadence to pace it. This piece covers what dbmt does, how to run it from a Program document, the key compact-side options (-ct / -cnd / -tl / -range / -force) and updall-side options (-ut / -ftiNdays), and the one special case — -ods, which does a copy-style compact that reassigns the DBIID — and why that ties back to transaction logging and ODS upgrades.
2026.10.16 - Domino's Built-in Backup Task: Domino 12 Finally Ships Backup and Restore
Before Domino 12, database-level backup and restore meant wiring up a third-party tool (via the C API Toolkit). From 12, Domino ships Backup and Restore as built-in server tasks: one dominobackup.nsf configuration database lets you schedule backups and restore a single database on demand. This piece covers what it is, why — like DAOS — it must have transaction logging enabled first, how to build a config from the platform default in the Configuration view (the Main/Backup/Snapshot/Restore/Prune/Notification tabs), how to run it with load backup's switches (-b/-t/-i/-s/-p), and how to restore from the Database Inventory — including an easy trap: restoring outside the data directory reassigns the DBIID and invalidates the earlier transaction logs.
2026.10.15 - DAOS: Move Attachments Out of the NSF
The same attachment stored in dozens of documents, even across several databases, is how an NSF bloats. DAOS moves attachments out of the NSF and stores them, de-duplicated, as a single .nlo file on the server, leaving a reference called a 'ticket' in the document. This piece covers how it works (de-dup happens at save time, not in a later maintenance task), why you must enable transaction logging before it, how to set the Server document DAOS tab (base path, minimum size, deferred deletion) and add databases, and tier 2 moving cold attachments to S3; plus the reminder that after the attachments move out, you still compact the NSF to actually reclaim the space.
2026.10.14 - Domino Transaction Logging: It Replaces Routine Fixup
In the maintenance-command rules, 'is transaction logging on?' is always the branch that decides which option you type — with logging, don't run fixup routinely, compact with -b to keep the DBIID, and take a fresh backup after anything that changes the DBIID. But what is transaction logging, and why does it flip so many rules at once? This piece explains it: it records database changes into one log and replays it automatically on a crash restart, so logged databases need no consistency check (and no routine fixup); the three styles (circular / linear / archived) and their trade-offs; and why operations that rebuild a database (copy-style compact, fixup on a corrupt database, enabling logging) assign a new DBIID, invalidate the old log, and force a full backup.
2026.10.13 - Domino on Linux: the Case-Sensitivity Trap, and Why the Path Cache Hides It
After moving Domino from Windows to Linux, a URL with the wrong case (the folder on disk is /FFH/ but you request /ffh/) sometimes 404s with 'File does not exist' and sometimes works — the same URL, flaky, and it always works by the time you go to check, so everyone assumes it's fine. The truth: Linux's filesystem is case-sensitive, and the Domino HTTP task caches successful path lookups, so the 404 only shows up when the cache is cold AND the very first hit uses the wrong case. This piece uses three rounds of curl tests on a real R12 (12.0.2 FP8) Linux server to reproduce the trap cleanly, explains why it stays hidden, and measures the symlink and directory-link workarounds.
2026.10.09 - Domino Maintenance Commands in Practice — Option Rules, the Transaction-Log Branch, and Scenario Playbooks (Daily / Repair / Won't Open)
The options for updall, compact, and fixup are all over the web, but the same compact run with -b vs -B — and whether transaction logging is on — produces wildly different results: one keeps the DBIID, the other reassigns it and breaks your backup chain. This piece turns HCL's own maintenance manual into a practical reference: three syntax rules first (parameter position, case-sensitivity -b≠-B, keyword options), then compact's three compaction styles, then the full command sequences for three scenarios — scheduled daily maintenance, corruption repair, and work-hours-no-downtime — each marked for whether transaction logging is enabled.
2026.10.08 - The 12.0.2 'Documents Vanish Under a Sub-Category' Regression Family — Four KBs, Two notes.ini Parameters, Matched to Your Interface
After upgrading to 12.0.2, a multi-level categorized view shows only the topmost layer — the documents under the sub-category are gone. You search the symptom, find a KB, add its notes.ini parameter, and it 'did not work' — because this isn't one bug, it's a whole family: four official KBs, two different parameters. The client-side @PickList and embedded views use EnableExtendedFindByKey=0 (fixed in FP1); XPages uses DISABLE_REFIND_IN_READENTRIES=1 (fixed in FP3/14.0). This piece maps all four KBs into one table so you match your interface first, then set the right parameter.
2026.10.07 - XPages: Documents Don't Show When a Multi-Column Category's Next Column Is Also a Category — the 12.0.2 Regression
An XPages view categorized on multiple columns: you apply a filter, and where the next column is still a category, the screen shows the category but the documents under it disappear — in 12.0.2, though 12.0.1 works. It's an HCL-acknowledged regression (KB0102504 / SPR# MNIACMGKUV), introduced when 12.0.2 fixed another bug (SPR# PJONB7GRUL). The workaround is DISABLE_REFIND_IN_READENTRIES=1 in the server notes.ini; the real fix is 12.0.2 FP3 or 14.0. This covers the symptom, why it happens, the workaround and fix, and the wider family of 12.0.2 sub-category-display regressions (like the @PickList variant in KB0102042, which needs a different parameter and fix version) so you can match the right one.
2026.10.06 - Field Notes from panagenda's MakeNotesFaster Webinar: Slow Notes Is Usually Configuration, Not Old Laptops
In panagenda's MakeNotesFaster webinar, Christoph Adler breaks HCL Notes 14.5.1 FP1 client performance on Windows down to two decisions: run the right version, configure it right. Here are the points most useful to admins — one brutal real-world customer number, why ODS quietly steals startup time on every open, whether you should delete cache.ndk regularly (he debunks the myth outright), keeping the data directory off network shares, the three traps in an antivirus exclusion set, and the Monday-morning checklist he closes with.
2026.09.26 - The Two Jobs of dircat: You Think It Only Builds the Directory Catalog — Since Domino 12 It Also Runs Entitlement Auditing
See dircat (Directory Cataloger) in show tasks and most people think 'directory catalog' — aggregating multiple Domino Directories into one lookup-friendly directory. That's its day job. But since Domino 12 the task quietly took a second one: aggregating each server's entitlement data into entitlements.nsf, a licensing-compliance audit with nothing to do with directories. This covers dircat's real job (condensed vs extended catalogs, and why DIRCAT5.NTF isn't CATALOG.NTF), its hidden second role since Domino 12, and how one task with two jobs bites.
2026.09.25 - Who Is the Domain Administration Server? One Domino ACL Setting Behind Entitlement Aggregation, CertMgr, and AdminP
An additional server cold-boots and floods the console every 5 seconds with 'Error connecting to server…', trying to reach every server in the domain. The culprit wasn't entitlement config at all — it was a single ACL setting that had quietly made this server the 'domain administration server.' This piece covers how many meanings 'administration server' has in Domino, what actually decides the domain-admin identity, which subsystems it silently drives (domain-wide entitlement aggregation, CertMgr, AdminP), and how to split those responsibilities apart.
2026.09.24 - Why Deleted Documents Come Back: Deletion Stubs, the Purge Interval, and Two Ways They Resurrect
You delete a document and days later it's back — not a haunting. In Domino a delete doesn't erase the document; it leaves a deletion stub, a marker that lets replication carry "this one was deleted" to the other replicas. Stubs get cleaned up on the purge interval (default 90 days). Documents "resurrect" for one of two reasons: the stub was purged before it replicated, or the same document was edited on one replica and deleted on another and the edit won. This piece explains the mechanism, both causes, and the settings that prevent it.
2026.09.19 - updall, fixup, compact: Which One to Run When a Database Is Broken, Bloated, or Its Views Are Wrong
Domino's three database-maintenance commands are the easiest to reach for blindly: run fixup because a view is stale, run fixup because the file got fat, run compact because it won't open — and get nowhere. Each treats a different illness: updall handles indexes (views / full-text), fixup repairs corruption (documents / structure), compact reclaims space (bloat). This piece sorts them by symptom, plus the official escalation order for corruption: updall first, then fixup, then compact -c.
2026.09.18 - Domino Server Troubleshooting: Before You Restart the Whole Server, Run These Console Commands
Something's off with the server — a feature stopped working, a task looks stuck, memory or disk is tight. The reflex is to restart the whole server, but that's blunt and wipes the scene. This piece organizes the most useful Domino console commands by the problem you're facing: show tasks to see what's running/stuck, show server for overall health, restart task <task> to restart just the one misbehaving task (e.g. restart task http, not the whole box), tell http show thread state to find a stuck thread, and dbcache show/flush/disable for the database cache. Look first, then decide what to touch.
2026.09.17 - Wiring Domino CertMgr to Let's Encrypt: Automatic TLS Certificate Requests and Renewals over ACME
Manual certificate import still means swapping every 90 days, and still means forgetting. This piece (part two of the certstore series) covers CertMgr's real killer feature: requesting, configuring, and renewing free, trusted TLS certificates from Let's Encrypt automatically over the ACME protocol. Set up the two ACME account profiles (Staging/Production) and Global Settings, walk the request flow and the six things CertMgr does automatically after Submit, understand HTTP-01 vs DNS-01 challenges, and see why the micro CA is test-only, plus ECDSA and key rollover.
2026.09.03 - Getting Started with Domino Certificate Management: CertMgr and certstore.nsf Instead of Scattered .kyr Keyrings
Since Domino 12, TLS certificates no longer live as .kyr keyring files scattered across each server's disk — one CertMgr server task plus one certstore.nsf database manages them all: certificates stored in TLS Credentials documents, private keys encrypted with 256-bit AES, protected by the database ACL, and readable only by the servers you choose. Part one of the certstore series: the model, how to stand certstore.nsf up, what a TLS Credentials document holds, and the full steps to import an existing third-party CA certificate.
2026.09.02 - Managing the Full-Text Index from Code: CreateFTIndex, UpdateFTIndex, and the Local-vs-Server Split
FTSearch needs a full-text index to be fast — and to support wildcards and relevance ranking — and NotesDatabase can create, update, and remove one from LotusScript. The catch is a split almost nobody expects: CreateFTIndex / UpdateFTIndex / RemoveFTIndex work on LOCAL databases only, while FTIndexFrequency is server-only, and server indexes are actually managed by the Updall task (updall -X rebuilds, it doesn't create). This article covers the options bitmask, the create-vs-update distinction, and that split.
2026.07.17 - NotesAdministrationProcess: Filing AdminP Requests from LotusScript
Renaming a user, deleting one cleanly, recertifying, moving a mail file, changing an Internet password — these are AdminP jobs you'd normally click through in the Administration client. NotesAdministrationProcess files those same requests from code into admin4.nsf. This article covers session.CreateAdministrationProcess, the request methods and their note-ID return value, the certifier properties, and the three things that trip people up: it needs unrestricted rights, it's asynchronous, and '*' means 'no change'.
2026.06.29 - NotesIDVault: Pulling IDs from the ID Vault, Syncing, and Resetting Passwords in Code
The ID Vault is Domino's policy-based facility for centrally storing user ID files. NotesIDVault lets you operate it from code — pull a user's ID file out of the vault, sync a local ID back, check whether someone's ID is in the vault, even reset a vault password. This article covers getting it, the GetUserIDFile / SyncUserIDFile / IsIDInVault / ResetUserPassword / PutUserIDFile methods, its relationship to NotesUserID, and the permission prerequisites for these operations.
2026.06.25 - The ODS Developers Rarely Notice: Domino's Database Format Versions, and What Actually Triggers an Upgrade
You write LotusScript / XPages all day and probably never think about a database's ODS (on-disk structure) version — until a feature like LargeSummary needs a certain ODS, or you move an old database between servers and aren't sure whether its ODS follows. This article covers the ODS-to-release mapping from a developer's angle, the most counterintuitive point (upgrading the server version does not upgrade the ODS), and exactly what triggers an ODS change and what governs it — then answers a concrete case: an R9 ODS51 database, new-copied from an R12 client to an R12 server, does its ODS change automatically?
2026.06.21 - Domino REST API: v1.1.7 Is the Current Latest — New Endpoints and Fixes
HCL Domino REST API's current latest release is v1.1.7 (shipped April 7, 2026), adding endpoints for calendar profiles, PIM unread state, and message updates, plus fixes for attachment download, Microsoft Entra ID auth, and meeting invitations.
2026.05.04 - Domino V12 lets notes.ini hold multiple HTTPAdditionalRespHeader entries
Older Domino releases let you put exactly one HTTPAdditionalRespHeader in notes.ini — a second line silently overwrote the first. HCL added a numbered convention (HTTPAdditionalRespHeader01, 02, …) in V12.0.x so you can ship a full security-header baseline through notes.ini alone, which is the only path that still works when HTTP won't start and the Internet Site documents are unreachable.
2026.04.28 - HCL Domino REST API Quickstart Guide
This guide walks you through installing, configuring, and starting with the HCL Domino REST API, enabling access to Domino databases via a modern RESTful interface.
2026.04.28