There are several places to check for passwords that seem to expire. One is the user's password expiration time. It might not be set at all, and on a Trusted system, there is a default systemwide value for users without any password aging. Also, on a Trusted system, there is an account lifetime without login...it can be shorter or longer than the expiration time. If the user does not have an account lifetime set, then the system's default takes over. To see the systemwide settings:
/usr/lbin/getprdef -m lftm,exptm
The lftm is the maximum lifetime for a password after changing it, and exptm is the number of days until the system asks to change it. Check which type of lockout is happening for these users:
/usr/lbin/getprpw -m lockout SomeUserName
The lockout value is ####### where each position is 0 or 1:
1 past password lifetime
2 past last login time (inactive account)
3 past absolute account lifetime
4 exceeded unsuccessful login attempts
5 password required and a null password
6 admin lock
7 password is a *
You can use SAM to change the lifetime for an unchanged login. The reason for having this additional timeout is that even if someone logs in with the correct password, rather than asking the user to change it, the login is locked so the administrator can determine why it has taken so long for the user to actually use the login.
Bill Hassell, sysadmin
