Trusted Mode password expiration - wrong behavior?

[FLQ]

Hi all,

OS = HP-UX 11.11/11.23

I did a Trusted Mode conversion on a system and encountered the never ending problem with the password expiration for all users.

1 - Using /usr/lbin/tsconvert ended with all users forced to change their password at next login. I caught the problem in time so revert back to Untrusted Mode.

2 - Using SAM I was able to convert the system to Trusted Mode but this time the password were not expired but the aging was "refreshed" to today's date. This is barely acceptable. :-(

My question is:

How can one put the system in Trusted Mode without changing the expiry date of each users to the date when the command was executed?

I mean to keep the actual expiry date for all accounts so when I put the system in Trusted Mode, the account that is setup to expire the day after I run the command will in fact expire the day after and not 60 days later. (passwords are set to expire every 60 days)

All this without having to write a script that will extract the expiry date and then "refresh" all accounts with their proper expiry date.

I hope it is clear enough.

Let me know

[Marvin Strong]

man modprpw

that command should allow you so do what you want.

[Steven E. Protter]

Shalom,

This is something that happened with some of my users on a trusted system at my last job. The bad news for me it was my department head's account.

There were two issues there. The command posted above needed to be running and the default password aging was not set right for the user.

I think the default password aging pollicy for your entire system is wrong in this case.

I'd suggest sam users .. change it globally.

SEP{

[FLQ]

Marvin,

I understand that "modprpw" command will do what I want but, as stated in my first post, I don't want to have to go back and modify each account with the previous expiry date because it means that I have to somehow keep the old expiry dates for each user and re-apply with "modprpw". IMO, it is an unnecessary step and that it should be done automatically by "/usr/lbin/tsconvert".

SEP,

The password aging policy is actually set to 60 days.

Using SAM to do the conversion will execute "/usr/lbin/modprpw -V" and set the expiry date to the date the command ran. This is what I'm trying to avoid.

TIA