Of course if you want to disable the account permanently, remove the UAF entry:
UAF> REMOVE user
A tip: I generally recommend when removing a user account you do it as:
UAF> REMOVE/NOREMOVE user
This leaves the RIGHTS identifier in RIGHTSLIST.DAT. This gives you a permanent record of the username/UIC mapping. So, if you ever need to reinstate the user, you can easily give them the same UIC. It also means that any objects still belonging to the user will be labelled with their name, rather than a UIC. Further, it helps prevent giving the same UIC to a new user, potentially granting them accidental access to objects owned by the original user (most security policies recommend against reusing UICs).
we actually do both ;-) Since in our development area we do have a large and fluctuating user community and sometimes people "forget" to fill out the paperwork to cancel accounts, we regularly check the SYSUAF for apparently dormant accounts. Then we first set them to disuser for another grace period and if nobody comes complaining they get eventually removed.
DISUSER Disables the account so the user cannot log in. For example, the DEFAULT account is disabled. By default, an account is enabled (NODISUSER). regards Mobeen
