There is no way to read a workstation ecls. You can set eclsetup=1 in the ini and that will force the names.nsf ecls down to the workstation. Best would be to setup / add to current policy (security) to force and stop the users from changing ecls. https://www.ibm.com/support/knowledgecenter/en/SSKTMJ_8.5.3/com.ibm.help.domino.admin85.doc/H_DYNAMICALLY_PUSHING_ADMIN_ECLS_OVER.html