Jumping over hurdles to upgrade Domino

Here’s what I had to do to the other day to apply Interim Fix 2 to a Domino server running version 9.0.1 Fixpack 4: Shut down Domino, the Domino Controller, the Java Console, NSD, and (wait for it, wait for it) Windows Management Instrumentation. Huh? Apparently WMI or one of its dependent apps grabs onto one or more Domino DLLs and won’t let go. Or some damn thing. One of the dependent apps was VMware Helper. I wonder if that was the culprit.  I remember running into a similar problem years ago upgrading Domino on a Xen VM. That might explain why one only sees problems like this occasionally (when least welcome, of course).

Anyway, until I stopped the WMI service, I kept getting this error when I tried to apply IF2:  “Notes/Domino related process is still running”. Thanks to Rainer Brandl for that tip.

This morning, I tried the same thing on another Domino server and it didn’t work. Same error message. More research. Thanks to Daniel Nashed for the following workaround:

Set Domino and NSD to Manual in Windows Services, rename the Domino directory, restart Windows, rename the Domino directory back to original, apply the patch, reset the services to automatic, restart NSD and Domino. 

Daniel didn’t actually say anything about resetting the Windows services. That was my own “belt-and-suspenders” add-on. Don’t know if it was really necessary. But I got past the error message. Finally. 

But IF2 still wouldn’t install because blah blah blah. Look at the UPGRADE.LOG. Wrong version of something in the Domino directory. I suspected I may have failed to notice if IF1 was installed on this server. So I ran the IF1 installer, which offered to uninstall IF1, and then did so. Then I succeeded, finally, in installing IF2. 

Had that not worked, I might have tried these other things: 

• Run the Fixpack 4 installer. See what it says. Depending on what it says, maybe uninstall/reinstall it, then try to install IF2 again.
• Run the 9.0.1 installer in Repair mode. Then reinstall FP4 and IF2.
• Uninstall 9.0.1, strip everything from the Program directory, reinstall all.

Luckily I didn’t have to get that radical. 

I love working on Sunday mornings.

Benefits of SmartCloud: The Network Effect

An interesting aspect of IBM Connections Cloud (formerly known as IBM SmartCloud for Social Business) is that all organizations that participate in it belong to a single directory. That fact has some useful implications. In particular it means that, if they want to, Connections Cloud users can interact, within Connections Cloud, with other Connections Cloud users outside their own organization. Here's an example of what I mean:

My organization, Rockteam, is an IBM Business Partner providing software and hardware services for a number of IBM customers. Years ago Rockteam migrated our mail to Connections Cloud (back when it was branded LotusLive), and later we subscribed to the features known until recently as IBM SmartCloud Connections (now known as IBM Connections Social Cloud), IBM SmartCloud Meetings (now IBM Connections Meetings Cloud), and IBM SmartCloud Docs (now IBM Connections Docs Cloud) in order to maximally leverage Connections Cloud's benefits. My own role at Rockteam is to help our clients install, configure, and maintain a variety of IBM's server products. I also help my customers (and other IBM Business Partners) to join and migrate their mail to IBM Connections Cloud themselves and to find the best ways to maximize its benefits for their organizations. In other words, I develop relationships; and IBM Connections Cloud can strengthen these relationships.

A nice thing about using Connections Cloud for mail is that Sametime Instant Messaging is included with it. What's really nice about that is that, not only can you chat with the other Connections Cloud mail users in your own organization, but you can also chat with any other Connections Cloud mail user in any other organization. For me that provides two benefits:

1. I can chat up IBM experts when I need to.
2. My customers can chat me up when they need to.

How does that work? Well, a few weeks ago I wrote in this very post a detailed description of a procedure for enabling SmartCloud users outside my SmartCloud organization to see my SmartCloud Profile. From there I described how one could parlay that into things like chatting with each other in Sametime Instant Messaging. Then, a week or two later, at approximately the same time as it rebranded SmartCloud to Connections Cloud, IBM rolled out a major upgrade to SmartCloud Connections. Mostly the upgrade added and improved features. It also disabled a feature. Yes, the one I described in so much detail here. The ability to publicize to other SmartCloud Organization one's Profile.

I was dismayed at first because I thought the disabling of this feature meant that I would no longer be able to work with members of other Connections Cloud organizations using the powerful features of Connections Social Cloud or of Sametime Chat. But then I noticed that I was still a member of some non-Rockteam communities and I realized that there must still be a way to enable all that. So I did some digging. And what I discovered is that now you can enable all those things without first publicizing your profile.

All you have to do is this: Invite other Connections Cloud users to join your network; or accept their invitations to join their network. The only trick is that, when you do invite another Connections Cloud user to join your network, you have to use that person's Connections Cloud email address. Having done that (invited/accepted), the two of you can now work, er, collaborate with each other using all of the following Connections Cloud features:

• Each can see the other's full profile. 
• Each can see what other network contacts both have in common.
• Each can see what communities both belong to, and can invite the other to join communities.
• Each can add the other to his/her Sametime contact list, see the other's presence icon in the contact list, and chat the other up when the other also shows as present.
• Each can share files with the other and see a list of files the other has shared with him/her or made visible to his/her organization.
• Each can participate in activities with the other.
• Each can invite the other to meetings.
• Each can sever the network relationship at any time.

It's true that some of these benefits are available between Connections Cloud users and non-users, who you invite not to join your network, but rather to be guests in specific communities. But others, such as Sametime chatting, are only available within one's own organization or between networked SmartCloud users. As a Connections Cloud user who receives services from and provides services to other Connections Cloud users, I like this feature a lot.

How to force iNotes into Full Mode on a tablet computer

With IBM Notes Traveler and IBM Connections apps available for mobile devices, it's not all that often anymore that I try to get into IBM SmartCloud from a browser, especially on my phone, where the form factor is just too, too small. But on a tablet like the iPad it's still useful sometimes. Of course, when I do, if I try to look at my mail, calendar, or contacts, it defaults to displaying them in the iNotes UltraLight interface. That's fine most of the time and it's perfect for a phone with its, again, small screen. But a tablet's screen is big enough to accommodate the iNotes Full interface. And sometimes I wish I could switch over to it. Don't get me wrong. I think the iNotes UltraLight interface is brilliant. But sometimes it's just too minimalist.

IBM SmartCloud displays iNotes UltraLight mail interface in iPad's browser

 A few years ago I decided to go to Lotusphere without a laptop computer in tow. Having bought and fallen in love with an iPad I thought I'd try surviving a week that year with just the iPad, my iPhone and the laptops they provide at Lotusphere. And I managed just fine, but I wished I could bring up iNotes on the iPad in Full interface mode. Lotusphere was (and its successor Connect is) about the greatest place in the world to have such a wish because you can just go to any of the labs and talk to IBM's own experts on any subject. I did just that and the guys in the lab helped me figure out how to force iNotes into Full mode. We bookmarked it in Safari, I thanked them, and I went on my way (while, behind me I heard one of them say to another, "See, I told you people would want to use this stuff on an iPad".)

IBM SmartCloud can display iNotes Full mail interface in iPad's browser

I went years with that bookmark on my iPad, using it less and less frequently as I got more into the Traveler/Connections app groove and out of the SmartCloud-by-browser groove. (One reason for that is that the apps offer a much better editing experience, providing, as they do, access to Apple's double-edged editing tools.) Then, just the other day, I got a question from a customer, a new Notes/iNotes/SmartCloud Connections user, wanting to know if there was a way to get the Full mail/calendar/contacts interface on a tablet. Oh, yes there is, and I know how to do it! I went looking for my bookmark and, omigod, it was gone! I don't know where it went, but I could no longer find it on my iPad.

So I had to relearn how to force Full mode on a tablet. I experimented with the URL, but the darn thing kept coming up in UltraLight mode. I Googled it, but, surprise, it doesn't seem to be a topic that has been discussed much in GoogleSpace. What the heck, I even opened a PMR with IBM SmartCloud to find out if they knew the answer. But then, impatient for them to get back to me, I went back to work on the URL and (ta da!) I cracked it.

Here's the URL that appears in the Safari browser on the iPad when you click Mail in the SmartCloud interface and brings up iNotes UltraLight (substitute your own mail path name for the zeroes, ones, and twos):
https://mail.notes.na.collabserv.com/data0/11111111/22222222.nsf/iNotes/Mail/?OpenDocument&Form=m_HomeView

Here's how I changed it to force iNotes to come up in Full mode:
https://mail.notes.na.collabserv.com/data0/11111111/22222222.nsf/iNotes/Mail/?OpenDocument&ui=inotes_full

As you can see, the key (which I had missed initially) was not to add "&ui=iNotes_Full" but rather to substitute it for "&Form=m_HomeView". And here's a plus: Once you are in Full mode, you stay in Full mode. Touching any of the mail-related links on the screen returns that screen in Full mode as well.

The next thing that happened was that I got a call-back from IBM SmartCloud Support. I told the guy I had solved the problem and he said, "Oh, really? Would you please send me the solution, so we'll have it in case anyone else ever asks?" That made my day. Well, sort of. The fact that they didn't already know the answer reminded me that this is a solution in search of a problem. A smaller and smaller problem as IBM continues to enhance its mobile Traveler and Connections apps.

But, hey, it gives me, all from within the browser interface on my iPad, access to my mail views, folders, rules, archives, and delegated mail databases, all of the calendar views, my To Dos and Notebook entries, my iNotes preferences, and even the Sidebar-base Sametime Communications widget. Caveat: Not officially supported by IBM. And not, perhaps, 100% functional. I get occasional 404 errors; but when I click OK, Safari tries again and my data finally appears. And I haven't actually tested everything, so who knows what else might break?

I'm good with that. Thank, IBM, for some great software.

Copyright 2014 Rob Kirkland

Set Up your SmartCloud Meetings meeting room in the SmartCloud calendar

I am an IBM SmartCloud Notes and IBM SmartCloud Meetings user who works mostly remotely from my colleagues and customers. Therefore, when I create meeting invitations in Notes or iNotes, I like to add my SmartCloud Meetings meeting room and call-in information to virtually all of my meeting invitations. In fact, I do it even for face-to-face meetings because these days you just can't assume that nobody will want to attend remotely.

Including meeting room and call-in information in a meeting invitation is one-click easy. Well, almost. I have had new SmartCloud users try it and fail, then ask me how I do it. Their problem turns out to be that, before you can do it, you have to define a meeting room. 

The problem is that, where Sametime Meetings users are expected (and presumably taught how) to set up their own meeting rooms, SmartCloud Meetings users have a meeting room predefined for them and are expected to use that one meeting room exclusively. So nobody teaches them how to define a meeting room. After all, if their meeting room is predefined, they don't need to define one, right? 

 Er, wrong. When new SmartCloud Notes or iNotes users try to include meeting room information in a meeting invitation, they are presented with an empty list of meetings, as illustrated below, and no information as to what they should do about it. Where is their predefined meeting room?

Because it's the only available option, they try clicking New, which brings up the form below, which presents two problems:

• It prompts them for the Meeting URL, which they don't know how to provide. 
• It does not prompt them for the Meeting ID, which they also need and also don't know how to provide.

What nobody tells the new user is: 

• That one needs to gather the information for this screen beforehand; and
• Where to get this information.

And there's another problem. If the user tries to navigate directly between the meeting invitation screen and the screen where the meeting information appears, the one screen closes before the other one opens. The user needs to navigate in such a way that both screens remain open so that she can easily copy/paste the information. In other words, the user needs to open the meetings dashboard in one tab or browser window and the calendar app in another.

Here is what the user can do to easily gather the needed information and use it to create a meeting room:

1. Log into IBM SmartCloud, then navigate to the SmartCloud Meetings dashboard. (Click Apps, Meetings (New) in the Ribbon or, if your organization is "newish" to SmartCloud, it might just say "Meetings".) 
   
2. There one sees that a meeting room has indeed been predefined. There, too, are the Meeting ID and Meeting URL.
   
3. Optionally (but recommended), set a password for the predefined meeting room.
   
4. Leave the Meetings dashboard screen open while you open a meeting invitation. Do this as follows: 
1. Click the IBM SmartCloud for Social Business tab in the browser to open the original SmartCloud landing page. Or open a new browser window and connect to SmartCloud again from that window.
2. Then click the "Sign in" link again to open SmartCloud again in yet another tab or window. Result: Three browser tabs and/or windows are open: The SmartCloud landing page, the Meetings page, and the user's Home page. The user can now copy/paste between screens.
5. Under this new browser tab or window, navigate back to the iNotes calendar and create a new meeting invitation. There, click the links again to return to the New Online Meeting dialog. Now do the following:
1. Change "Select service" to "IBM SmartCloud Meetings". This causes an additional field (Meeting ID) to appear in the form.
2. In "Meeting room name", enter any name you want for your meeting room.
3. In "Meeting URL", paste the URL from the "Your meeting link" field on the Meetings dashboard (under the Meetings browser tab).
4. In "Meeting ID", paste the eight-digit number from the "Meeting ID" field on the Meetings dashboard.
5. In "Password" enter or paste the meeting room password if you set one.
6. In "Call-in information" enter the dialing information to access your bridge or conference line. If one has to dial a phone number followed later by another number, such as a PIN, a conference bridge or an extension, separate the two sequences with either one or more commas (",") or a semi-colon (";"). If the last set of numbers requires a pound symbol ("#") at the end, add it here. That way the invitee doesn't have to dial it manually at meeting time.
1. Each comma inserts a two-second pause into the dialing sequence. One comma is usually sufficient, but you can insert more than one for a longer pause. 
2. A semi-colon inserts a "wait", where the numbers following the semi-colon aren't dialed until you manually tell the phone to dial them. 
3. On smartphones a soft button typically appears on-screen that, when touched, initiates the waiting number sequence. 
7. The completed dialog looks similar to this:
   
8. Click OK. The newly defined meeting room appears in the list. It is selected. Details about it appear in the bottom portion of the dialog.
   
9. Click OK to close the dialog. The meeting room and call-in information appear in the meeting invitation.
   
6. Either complete or cancel the meeting invitation. You're finished.

From now on, the newly defined meeting room will appear in the list, preselected, in the Reserve Meeting Room dialog, and you can just click Online Meeting, then OK, to include its information in a meeting invitation. 

For some meetings you don't really need a meeting room; rather, all you need is call-in information. Here is how to set up your call-in information in SmartCloud so you can insert it into meeting invitations with a single mouse click:

1. Log into SmartCloud and open your mail or calendar window. If you are already logged into SmartCloud and you have open tabs that have unsaved edits, save them before you proceed further, because when you save your preferences in step 5 below, all open tabs will close and unsaved edits will be discarded.
2. Click More in the Mail or Calendar Taskbar, then click Preferences. The Preferences page will appear under another tab in the mail or calendar window.
3. In the navigation (left) pane of the Preferences page, expand Calendar, then select Meeting. The contents of the main (right) pane will change accordingly.
4. Under Conference Call Information enter your calling number. Use commas (",") to introduce two-second delays or semi-colons (";") to introduce waits, as previously described.
5. Click Save and Close. Click OK in the warning dialog that appears. All SmartCloud tabs will close, then the Mail or Calendar tab from which you initiated the above steps will reopen.

Now, whenever you create a meeting, you can add your call-in information by clicking the "Call-in Number" link in iNotes or checking the "Include conference call information in the Location" checkbox in Notes.
Copyright 2014 Rob Kirkland, Rockteam

How to enter a conference call phone number into a meeting invitation

I love my iPhone. I love that I can open meeting invitations on it and that the meeting phone number is recognized and highlighted, so that, if I touch it, the iPhone dials it for me. I love it even more if the meeting organizer entered the next bit of information correctly. That would be the conference access code. If entered correctly, the iPhone either pauses for a couple seconds, then dials it, or the iPhone displays a button (or maybe just the words - depends on the iOS version) that says “Dial xxxxxxx#” (where “xxxxxxx#” is the conference access code, which in this example ends with the pound/hash sign).

Trouble is, many users don’t know how to enter the phone information so that the iPhone (and probably the Android, too) will work this way. The way you do it is like one of these:

nnnnnnnnnn,xxxxxxx#
or
nnnnnnnnnn;xxxxxxx#

The n’s are the phone number. The x’s are the conference access code. In the first example, they are separated by a comma, which causes the phone to pause two seconds, then continue with the next string of numerals. In the second example, they are separated by a semicolon, which causes the phone to pause until you signal it to continue, which you do, on my iPhone, by touching the words “Dial xxxxxxx#”.

This works with extensions too. And it works with successive strings. For example, someone the other day told me that his phone number was (xxx)xxx-xxxx, then dial 8, then dial 123. In my contact record for him, I entered this: (xxx)xxx-xxxx,8,123

Here’s what people do that I hate, In the meeting invitation, they (oh, so helpfully) enter this sort of thing:

Conference Dial-in Number: (xxx)xxx-xxxxParticipant Access Code: xxxxxxx#

Now, when I want to dial in, I have to do one of the following:

• Write down the access code, then dial in, then manually enter the access code.
• Memorize the access code, then dial in, then manually enter the access code.
• Dial in, go back to the calendar app and look at the access code, memorize it or write it down, then return to the phone app and manually enter the access code.

This is a drag.

Not helpful.

No thanks.

The next time someone does this to you, send them the URL to this blog post.

How to turn a Notes View into a Widget: It's easy, but not always as easy as you may think.

The other day IBM Tech Support showed me a cool, maybe undocumented feature of Notes 8.5.x. The following day I discovered a useful application of the feature. For my reader who doesn't have time to read my witty and snappily written (but, okay, long-winded) prose below, the short (two-sentence) version of this post is (so as not to spoil it for my other reader) at the very end of this post.

You may know that the personal productivity Notes apps (mail, calendar, to-do, contacts, notebook) are composite apps. That means the pieces of them that appear on screen (navigation pane, views, forms) are written as "components" that  can be rearranged on screen and wired up to work with each other in custom ways using the Composite Application Editor. The Composite App Editor is available (if installed) when a composite app is open on screen. Get to it in the Actions menu by clicking Edit Application. One of the nice aspects of composite apps is that they aren't confined to running in Notes. Each component can potentially be combined with any other component (whether originally intended ro work together or not) and can be run in other Eclipse-based containers or in WebSphere Portal.

All this only works in Notes when it is running in Standard Mode. In Basic Mode, these apps are plain old Notes apps, like any other. That means, of course, that much of the code underlying the new functionality is written in Java. And when something goes wrong in Notes these days, it's almost always a Java-driven piece of the product that goes haywire. (The C++ code, having been around and debugged since the beginning of time, is pretty rock solid in Notes. The Java code, into which Notes was cradled starting in version 8.0, has a way to go before the significant bugs get worked out of it.)

Anyway, I was on the phone with IBM Tech Support (a great, extremely helpful bunch of people, by the way) and we needed to know if a problem we were troubleshooting was in the Java or C++ portion of the product. To find out, we had to go to Basic Mode. If the problem continued to rear its ugly head, we would know to look for it not in the Java code but on the C++ side. Normally, you get into Basic Mode by restarting Notes, appending either the -sa or -basic command line argument. (I guess nobody (including me) could remember "-sa" (because, like, who knows what "sa" stands for?), so later they added "-basic". Thank you, IBM, very much.)

Restart Notes, kind of a hassle. But the Tech Support guy clued me in to a neat trick. Instead of restarting all of Notes, you can leave Notes running in Standard Mode and just start an individual application in Basic Mode by holding down Ctrl+Alt while clicking the app in the Start List. Whoa! Too Cool! (I'm pretty geeky. This made my day.)

So, we did that and, of course, the problem disappeared. Like I said, Notes problems these days occur in the Java code, not the rock solid C++ code. End of that story.

The following day I discovered how this trick could come in handy with respect to Widgets, yet another nice, Java-based feature that appeared in Notes in, er, Notes 8.0.1, I think. The Widget app is a Notes Sidebar app. Non-running widgets appear there as tiles or in a list. When you run a widget, it opens in one of several places: in the Sidebar, in a tab on the main portion of the Notes app, or in its own window. Nice versatility, that. One of the sweet, stupidly easy things you can do with Widgets is turn any Notes view into a widget. (Well, almost any view - keep reading)

I had been having a dialog with my friend Dan about some Notes limitations that he had been experiencing. He had been getting pretty fed up by Notes and was saying things like "Notes has a really crappy search tool" and "Notes isn't very customizable", to which, to his surprise, I answered "Are you kidding? Notes has great search functionality" and "Are you kidding? Note is fabulously customizable."

One of the things Dan complained about was that the scrolling was way too slow when he wanted to file an email. It turns out I couldn't help him speed up the scrolling. It's a known issue when a Notes Mail database (running in Standard Mode) has more than, say, 200-250 folders, that scrolling slo-o-ws down. So, as a workaround, Dan wanted to close the mini-view window in the lower left of his Notes screen, so that he could maximize his folder pane to reveal more of his (insanely huge number of) folders. But he also uses the Follow Up mini view to keep track of things he needs to get done. So I pointed out that he could use the regular follow-up view. To which he replied that he needs it visible all the time, not hidden amongst the tabbed views.

That's when it occurred to me that he could turn the Follow Up view (the big one, not the mini-view) into a widget. And that's when I discovered that NOT all views can become widgets with stupid ease. Views configured as Components cannot be easily turned into standalone widgets. And that's when I realized that the Ctrl+Alt trick might come in handy.

Okay, so I wanted to turn Dan's Follow Up view into a widget that could appear in his right sidebar OR in a little window anywhere on his screen that suited Dan. When I say "stupidly easy", here's what I mean: To turn a Notes view into a widget, you open the view, click the "Configure a widget from Current Context" icon in the Toolbar (or use the menu), select "Open this view", and click OK.

(Life will never get easier than that. When it does, it will be because I, Robot, am running things now and you humans can just sit back and suck your thumbs.)

But when I tried to make a widget out of the Follow Up view, the dialog box didn't offer to "Open this view". Instead, I could "Just configure a widget for now" or "Wire as an action". Neither option actually caused the view to appear in a widget window. Arrgh! I had to scratch my head for awhile before I realized why. Luckily, the cause and solution dawned on me before the headscratching drew blood from my thinning scalp.

In a Composite App such as Notes Mail, views are not really views like they are in regular Notes apps. They are Components. Because I was trying to turn a Component into a widget, I was getting a whole other, not very useful set of choices than I expected.

But, wait! What if I open Notes Mail in Basic Mode? Would I be able to turn the Follow Up view into a widget then? The answer, to make this long story less long, is YES. Worked like a charm.

So, to recap:

1. You can open a composite app like Notes Mail in Basic Mode when Notes is still running in Standard Mode by pressing Ctrl+Alt while clicking the app's link in the Open List.
2. You can turn a view in a composite app like Notes Mail into a widget by first opening the app in Basic Mode as in #1, then clicking the "Configure a Widget from Current Context" icon in the Toolbar, selecting "Open this view", and clicking OK.

Pretty cool, nay?

A satisfying ending to a Domino 8.5.2 installation dilemma

Today I had one of those "walk-on-water" moments that occasionally make consulting satisfying. Over the weekend I assisted a client in upgrading nine Domino servers from version 7.0.2 to 8.5.2. The marathon upgrade went generally smoothly. The main problem with it was there were just not enough hours in the weekend to upgrade (via compact -c) all of the databases on all of the servers. In particular, the headquarters mail server has an eye-popping number of multi-gigabyte mail databases on it. Those top execs just can't bear to part with any of their mail, and of course you can't enforce quotas against them; they'd have you (a lowly tech) drawn-and-quartered if you tried. So the one mail server never did get all of its databases upgraded to ODS 51. But except for that and a couple other minor problems, everything was working great on Monday morning.

Then a field technician in England reported that he couldn't set up a Notes workstation for a user who had been registered the previous week. The Notes setup kept failing with the following error message:

The Policy and/or Settings document assigned to you has been edited by an unauthorized person. Please notify your Administrator that you cannot proceed with the client setup.

Some Googling revealed that this error message arises when a policy or settings document is (as the message plainly says) signed by one who is unauthorized to sign it.. How could this happen? As follows: An administrator might in the past have created Policy and/or Settings documents that worked just fine. But then the administrator left the company and his account was removed from the domain. As a result, the retired administrator's signatures on the Policy and/or Settings documents were no longer those of an authorized signer, which is defined as one who has Editor access to the Domino Directory and is assigned the Policy Creator and Policy Modifier roles. See Technotes 1110644 and 1205444. Both of these Technotes state further that, to re-sign a Policy or Settings document you can, among other techniques, edit and save it.

How did this apply to us? That was not clear. As we could plainly see in the Policies and Settings views, the signer of all of the the Policy and Settings documents in the domain was a generic user named "Administrator" who is still to this day being used to create new users and who has the requisite access rights and roles assigned. So the error message seemed to be bogus, telling us something which was demonstrably untrue. Nonetheless, we tried editing/saving the policy and settings documents to apply new signatures. And, according to the Policies and Settings views, this worked. The views showed that each newly saved document had a new signer. But even though this new signer also had sufficient rights and roles assigned, we discovered that we could not register a new user into the England OU. So our problem was not only that we couldn't set up a new workstation for users registered before the upgrade, but also that we couldn't register new users after the upgrade.

We were scratching our heads over this and hunkering down for a long siege against this problem, when one of us had the bright idea of looking at the console of the mail server in question. (In this particular domain, there are several regional OUs. Each region also has a dedicated mail server. Also, each OU has an organizational policy with several OU-specific settings documents assigned to it. So our problem was affecting the England OU, the England mail server, and the England-specific policy and settings documents.)

There on the England mail server's console, in bright purple letters, was a cascade of error messages, repeating every few seconds:

Policies and settings documents signed by XXXXX are no longer valid because this person does not have the required access level or roles to the Domino Directory.

More Googling revealed that this new error message had the same cause as the earlier message, that is, that a Policy or Settings document was signed by an insufficiently authorized entity. The server was trying to apply a mail policy to the mail users on the server, but it didn't like the signature on the policy or mail settings document. However, this message told us one other bit of information that the earlier message had left out, which was that the Policy or Settings document was signed by the mail server itself, not, as the Policies and Settings views claimed, by the Administrator who actually created or last edited each document. Either the error message or the views were lying to us.

But the server did not in fact have the Policy Creator or Policy Modifier roles assigned to it in the ACL of the Domino Directory. So that meant that the error messages were perhaps not bogus after all. Assigning those roles to the server in the ACL should have solved our problem. We'll never know, however, if it would have done so, because our second bout with Google revealed one other fact -- that there was another (newer?) way to re-sign the Policies and Settings documents:

Select the documents in the Policies or Settings views, then in the Actions menu choose Resign Policy.

We tried that and it worked like magic. The cascade of messages in the server's console abruptly stopped. Thereafter, we found we could once again register new users and set up Notes for them. Later we checked the other mail servers and discovered that the Mexico server was experiencing the same problem. So we re-signed all of the policies and settings documents. Just like that, the Mexico server's messages stopped too.

Conclusion: Something happened that shouldn't have when we upgraded two of the nine servers. Apparently that something is that, somehow, the upgraded servers' signatures were applied to the Policy and/or Settings documents. Also, the Policies and Settings views tell us that the last editor of a document is the signer of it, which makes sense. The Technotes cited above tell us that too. But in our case saving the Policy or Settings document did not apply a new signature to it. So the view is misleading in that regard (and so are the Technotes). I think I'll tell Lotus about this.