User gets status DISABLED

[H. Sterken]

Hi,

One of my 150 users on my AS/400 (V4R4, last PTF-cum) userprofile gets
DISABLED about 15 minutes after he has signed on.
In QSYSOPR I get CPF1393 telling me that subsytem QSERVER has disabled
the user. Looking at the details I see that job QPWFSERVSO has send the
message and the program used is QSYSGNON.
Enabeling the user means that 15 minutes later he is again disabled.

I've looked at the userprofile, in the security tools, in the
PTF-covers, on DEJA but found nothing.

Can anyone help?

Regards,

Henk Sterken
Unidek Bouwelementen

[NObsw...@invalidassura.ch]

I suppose this is happening on a PC and in a Windows environment.
I think the PC is trying to contact the AS/400 with the PC userprofil
(which exists on the AS/400) and the PC password (which is different on
the AS/400).
After trying a few times, the AS/400 decides it is time to disable
userprofile.
Try changing the Windows logon password and set it to the same password as
on the AS/400.

Hope this helps.
Bas.

[H. Sterken]

I had already thought of this. The user isn't using Windows PC but an IBM
NetStation and his first login is succesfull, but about 15 minutes later his
userprofile is disabled.
I myself am using an NT-workstation PC using client-access. I login using my
own profile and everything works fine. When I open an additional 5250-session
and login as my problemuser the same problem occurs. His profile is disabled
after 15 minutes. So I don't think the problem is client-related.

Henk Sterken
Unidek Bouwelementen

NObsw...@INVALIDassura.ch schreef:

[Bernard Bandiera]

Is your unlucky user connected with TCP/IP ? If so, you could use STRCMNTRC to
spy the TCP frames between the AS/400 and the workstation and see what is wrong
about the dialog.

--
Bernard Bandiera - ADP GSI D.O. Eybens - France
mailto:Bernard....@fr.adp.com

[Jon K Wold]

The job QPWFSERV is for the Client Access ByteStream component, used by
part of OpNav in Express and used as the network drive support in CA
V3R2M0 and previous, and QSYSGNON reads like security signon -- so one
possibility is that the user has CA and a network drive and an incorrect
PW (perhaps PW changed) associated with it -- every 15 min some PC
process attempts at least three times to connect (or one attempt every 5
min), and kapow goes the user.

On the PC, turn on History logging and/or Detail trace to see what msgs
get logged at that point.

Just guessing,
Jon

[Thomas]

Henk:

Just to be clear, you logon as this user and 15 minutes later the user
gets disabled? All you do is logon?

Does this user have an initial program? If so, are you certain of what
that program is doing?

Are you auditing for profile swaps? Set the QAUDLVL system value to
include *AUTFAIL and *SECURITY and watch for unusual activity during
those 15 minutes. Naturally, if the audit journal isn't active, it'll
need to be activated beforehand.

Tom Liotta

In article <39C20ED5...@unidek.nl>,

--
Tom Liotta, AS/400 Systems Programmer
The PowerTech Group, Inc.; http://www.400security.com
...and for you automated email spammers out there:
rhu...@fcc.gov jqu...@fcc.gov sn...@fcc.gov rch...@fcc.gov

Sent via Deja.com http://www.deja.com/
Before you buy.

[NObsw...@invalidassura.ch]

This is a weird one. How could QSERVER disable your user profil when
logging on thru 5250 which is (theoretically) handled by QINTER.
Could it be someone else's PC that is creating all the problems. Your
ProblemUser may have once established a connection to his directory
(AS/400 side) on
another PC and each time this PC is switched on, it asks for the password
that the PC user does not know or maybe not even realize it is asking for
a
password for a different user (( have seen just about everything :-)

Just guessing otherwise I am clueless
Regards
Bas

[H. Sterken]

I've considered this possibility. But the weird thing is that the userprofile
gets disabled after my user logs in. If some PC would be responsable I'd
expect the user to be disabled at different times, not that the disabeling
begins after his initial login.

At present I circumvent the problem by enabeling the user when he gets
disabled using a simple CL in the jobscedular.

Regards,

Henk Sterken
Unidek Bouwelementen

NObsw...@INVALIDassura.ch schreef:

> This is a weird one. How could QSERVER disable your user profil when

[NObsw...@invalidassura.ch]

Might there be something in your ProblemUser's initial program that is
causing the problem.
If you do a WRKSBMJOB *JOB after logon, is there a program that was
submitted that could cause the problem ?
If you set INLPGM to *NONE on the user profil and logon, does your user
still get disabled ?
When using WRKUSRJOB USER(ProblemUser) STATUS(*ACTIVE), do you find any
other jobs other than your own emulation ? Is one of the other jobs
causing the problem ? Can you view their joblog and see anything over
there?
Might there be a security issue like limited access for security officers
to certain workstations? Check QLMTSECOFR system value. Does your user
belong to this group (SPCAUT *SECADM on user profil).
Check WRKDIRRE (Getting desperate)
Have you applied latest PTF pack for networkstations (Got this one from
IBM)
Delete user profil and create a new one (Getting even more desperate)
Fire employe and hire someone else :-)

Good luck.
Bas

[Thomas]

Henk:

Do you have a terminal you can test the logon at? You've said what
happens when the user logs in from a network station and when the user
is logged in through a session on your NT workstation. What about at the
console? Eliminate any possibility of the client workstation being
involved.

Tom Liotta

In article <39C20ED5...@unidek.nl>,
"H. Sterken" <hste...@unidek.nl> wrote:
> I had already thought of this. The user isn't using Windows PC but an
IBM
> NetStation and his first login is succesfull, but about 15 minutes
later his
> userprofile is disabled.
> I myself am using an NT-workstation PC using client-access. I login
using my
> own profile and everything works fine. When I open an additional
5250-session
> and login as my problemuser the same problem occurs. His profile is
disabled
> after 15 minutes. So I don't think the problem is client-related.
>

> Henk Sterken
> Unidek Bouwelementen
>
> NObsw...@INVALIDassura.ch schreef:
>

[gostr...@fcci-group.com]

Qserver disabling the profile indicates that a client application is
trying to establish an ODBC connection to the as/400. Since the
problem also occurs when you signon from your PC using his ID I would
examine his network startup script. Look at any application that is
run on startup. Also look for any mapped drives that may point to an
as/400 library.

We have had problems with client server apps caching IDs and
passwords - especially if they use VB.

In article <39C0F34A...@unidek.nl>,
"H. Sterken" <hste...@unidek.nl> wrote:
> Hi,

>
> One of my 150 users on my AS/400 (V4R4, last PTF-cum) userprofile gets
> DISABLED about 15 minutes after he has signed on.
> In QSYSOPR I get CPF1393 telling me that subsytem QSERVER has disabled
> the user. Looking at the details I see that job QPWFSERVSO has send
the
> message and the program used is QSYSGNON.
> Enabeling the user means that 15 minutes later he is again disabled.
>
> I've looked at the userprofile, in the security tools, in the
> PTF-covers, on DEJA but found nothing.
>

> Can anyone help?

>
> Regards,
>
> Henk Sterken
> Unidek Bouwelementen
>
>