Discussion:
user getting locked out - how can I tell from what workstation
(too old to reply)
Gary Massengale
2006-10-05 11:55:03 UTC
Permalink
I have a user whose AS400 profile keeps getting locked out, but not by him.

how can I identify what PC or greenscreen the invalid signons are occuring
on?

gary
Gilbert Noetzel
2006-10-05 12:30:22 UTC
Permalink
Have you considered that this user is using an incorrect password?

Check the System Values on how many times a user can 'mispell' the
password before AS/400 shuts them off.

Just my thought on this issue.

Gil
Post by Gary Massengale
I have a user whose AS400 profile keeps getting locked out, but not by him.
how can I identify what PC or greenscreen the invalid signons are occuring
on?
gary
Gary Massengale
2006-10-05 12:40:34 UTC
Permalink
sure, I considered it, but this user is more capable than most.

I beleive rather that at some other workstation someone is logging in under
his ID.

possible that it defaults to his user ID, people do not really pay attention
to the ID when signing on.

I have signed on to PCs before to do some troubleshooting and someone comes
to that PC aferwards and doesnt notice that my user ID is there instead of
theirs and they try to sign on with their password and end up locking my
account out.

probably something like that happening here.

gary
Post by Gilbert Noetzel
Have you considered that this user is using an incorrect password?
Check the System Values on how many times a user can 'mispell' the
password before AS/400 shuts them off.
Just my thought on this issue.
Gil
Post by Gary Massengale
I have a user whose AS400 profile keeps getting locked out, but not by him.
how can I identify what PC or greenscreen the invalid signons are
occuring on?
gary
its me
2006-10-05 17:40:07 UTC
Permalink
If you display the system log (DSPLOG command),
page up and look for messages that indicate this problem,
sorry I'm not in front of an As/400 at the moment, but
the message text is something like 'Incorrect password entered
for user XXXX'. If you position the cursor to that message and
press F1, the additional information page should give you the
workstation name.
Alternatively, if someone is logging on via Client Access,
I'm not sure what happens there, or an FTP session. You may
not get messages for incorrect logon attempts there.
HTH
Post by Gary Massengale
sure, I considered it, but this user is more capable than most.
I beleive rather that at some other workstation someone is logging in
under his ID.
possible that it defaults to his user ID, people do not really pay
attention to the ID when signing on.
I have signed on to PCs before to do some troubleshooting and someone
comes to that PC aferwards and doesnt notice that my user ID is there
instead of theirs and they try to sign on with their password and end up
locking my account out.
probably something like that happening here.
gary
Post by Gilbert Noetzel
Have you considered that this user is using an incorrect password?
Check the System Values on how many times a user can 'mispell' the
password before AS/400 shuts them off.
Just my thought on this issue.
Gil
Post by Gary Massengale
I have a user whose AS400 profile keeps getting locked out, but not by him.
how can I identify what PC or greenscreen the invalid signons are
occuring on?
gary
Gary Massengale
2006-10-05 19:15:45 UTC
Permalink
thanks, I will give that a try.

gary
Post by its me
If you display the system log (DSPLOG command),
page up and look for messages that indicate this problem,
sorry I'm not in front of an As/400 at the moment, but
the message text is something like 'Incorrect password entered
for user XXXX'. If you position the cursor to that message and
press F1, the additional information page should give you the
workstation name.
Alternatively, if someone is logging on via Client Access,
I'm not sure what happens there, or an FTP session. You may
not get messages for incorrect logon attempts there.
HTH
Post by Gary Massengale
sure, I considered it, but this user is more capable than most.
I beleive rather that at some other workstation someone is logging in
under his ID.
possible that it defaults to his user ID, people do not really pay
attention to the ID when signing on.
I have signed on to PCs before to do some troubleshooting and someone
comes to that PC aferwards and doesnt notice that my user ID is there
instead of theirs and they try to sign on with their password and end up
locking my account out.
probably something like that happening here.
gary
Post by Gilbert Noetzel
Have you considered that this user is using an incorrect password?
Check the System Values on how many times a user can 'mispell' the
password before AS/400 shuts them off.
Just my thought on this issue.
Gil
Post by Gary Massengale
I have a user whose AS400 profile keeps getting locked out, but not by him.
how can I identify what PC or greenscreen the invalid signons are
occuring on?
gary
j***@yahoo.co.nz
2006-10-05 19:42:53 UTC
Permalink
Post by Gary Massengale
I have a user whose AS400 profile keeps getting locked out, but not by him.
how can I identify what PC or greenscreen the invalid signons are occuring
on?
gary
If you have security auditing turned on (and you should), you will be
able to find all this information in the audit journals. When an
incorrect password is entered, a PW entry is logged. When a profile is
changed (and this includes it being disabled for any reason), a CP
entry is logged. If the journals show an invalid password was entered
from "communications device", the IP address can be found by extracting
the information to the QASYPWJ5 model file (you'll need to copy it to
e.g. QTEMP first) using *TYPE5 for the outfile format. Note that the
type 5 output format is only available from V5R3 onwards.

Loading...