All domain1.com windows users logged in on any workstation

user cpu=@ + logon =@\@domain1.com

###########################################################
# APPLIES TO ALL OTHER USERS IN THE 'domain1.com' INTERNET DOMAIN LOGGED IN ON ANY 
# WORKSTATION.
user default  cpu=@ + logon=@\@domain1.com 
begin
#  OBJECT     ATTRIBUTES       ACCESS CAPABILITIES
# ----------  ------------     ----------------------
job           cpu=@ + logon =a@\@domain1.com  access=display
job           cpu=@             access=@
schedule                        access=@
resource                        access=@
prompt                          access=@
file                            access=@
calendar                        access=@
cpu           cpu=@             access=@
parameter     name=@ ~ name=r@  access=@
userobj       cpu=@ + logon=@   access=@
eventrule     name=@            access=add,delete,display,modify,list,unlock
action        provider=@        access=display,submit,use,list
event         provider=@        access=use
report        name=@            access=display  
runcygrp      name=@            access=add,delete,display,modify,use,list,unlock
vartable      name=g@,$default  access=add,delete,display,modify,use,list,unlock
wkldappl      name=@            access=add,delete,display,modify,list,unlock
lob           name=@            access=use
end
###########################################################

Windows Users in domain1.com which name begins with 'a' can display only jobs and can manage parameters which name not beginning with r. All others domain1.com windows user that is logged in on any workstation are given unrestricted access to all objects, except parameters that have names beginning with r. They are the only ones who can generate all kinds of plans and who can create, update, and delete event rule definitions. All users have access to all variable tables beginning with "g" and to the default table, irrespective of the default variable table name.