AS/400 user accounts

[Jakes]

Folks, we run a fairly old (S20 V4R4) system thats also very busy all
the time. Somewhere in October we started getting numerous user
accounts simply being disabled on a daily basis (not all of them
though), causing major havoc in trying to keep auxillary systems
running, users happy, et al. This is on-going every day. We are not a
typical AS/400 shop, so before I get a consultant in, can anybody give
us an idea why this would be happening or what would be a proper
troubleshooting approach? Thanks much!

[iSeriesDude]

Couple of things to check. First, check the job scheduler (WRKJOBSCHE) to
see if job QSECIDL1 exists. This job is added if someone were to run the
ANZPRFACT command with a specified number of days. If someone ran the
command and entered 1 for the number of days, then any profile object
who's last used date on the profile object is greater then one day, then
it will disable the profile.

The next place you check, assuming security auditing and the appropriate
system values are set, is the security audit journal. Enter the following
command...

DSPAUDJRNE ENTTYP(CP) FROMTIME('01/10/2006') OUTPUT(*)

You can adjust it for your desired time and date period. If a change to a
profile was done, it will show you the profile who changed it, what
profile they changed, and the date and time of the change. Armed with
the person who made the change enter the following command..

DSPJRN JRN(QAUDJRN) FROMTIME('01/10/2006') USRPRF(<user who made the
change>)

will display the internal details of the security audit journal (adjust
the date and time accordingly). Locate the time with associated entry of
type 'CP' and place a '5' next to it to display the entry. Press 'F10 if
its not already displaying the display audit entry details and it will
show you the who, job name, program, etc...everything you could possibly
want.

Hope that helps.

Thanks,
iSeriesDude.

Post by Jakes
Folks, we run a fairly old (S20 V4R4) system thats also very busy all
the time. Somewhere in October we started getting numerous user
accounts simply being disabled on a daily basis (not all of them
though), causing major havoc in trying to keep auxillary systems
running, users happy, et al. This is on-going every day. We are not a
typical AS/400 shop, so before I get a consultant in, can anybody give
us an idea why this would be happening or what would be a proper
troubleshooting approach? Thanks much!

[a***@bigfoot.com]

Another place to check is users trying to connect via iSeries Access or
Netserver. If these attempts fail, the userid can get disabled. I
had a company that gave everyone an "X" drive mapped to IFS. When
their windows passwords changed, they got disabled because the
Netserver share was failing. This can occur even if they aren't
"opening" the drive.
Also, there used to be an issue using mixed case passwords when
accessing via Netserver. I don't remember when it was fixed.

[Jakes]

Your first recommendation was right on the money... last used day on
the profile object was set to 3 days. Thank you.