CPF1107: Password not correct for user profile

What it means

When you press Enter on the IBM i sign-on display, the system looks up the user profile you named and checks the password against the one stored for it. If the profile exists but the password doesn't match, the sign-on is refused with CPF1107. The only change to the profile is that its count of sign-on attempts that weren't valid goes up by one.

That count matters. The system value QMAXSIGN sets how many failures in a row are allowed. When the limit is reached, the system takes the action set in QMAXSGNACN, which can vary off the display, disable the user profile, or both. One good sign-on resets the count to zero.

Newer releases behave differently. IBM changed the sign-on display so that it no longer tells an intruder which half of the sign-on was wrong. On IBM i 7.5 a wrong password and an unknown user ID both get CPF1120, and CPF1107 isn't sent. So you mostly see CPF1107 on releases before 7.5.

Common causes

• The password was mistyped. Caps Lock is the usual suspect.
• The system uses password level 2 or 3 (system value QPWDLVL), where passwords are case-sensitive and can be up to 128 characters. A password that worked in all capitals on an older system now has to be typed exactly.
• The emulator's keyboard map sends a different character than the one on the key. A known case is a 5250 session where Shift+2 had been mapped so that @ arrived as A. The password looks right to the user but isn't what the system receives.
• The password was changed or reset recently, by the user on another session or by the help desk, and the old one was typed.
• A PC client, script or saved connection keeps sending an old password. Each of those tries counts against the same profile.

How to find the problem

1. The message appears on the sign-on display itself. Put the cursor on it and press F1 to see the full text and the profile name.
2. An administrator can run DSPUSRPRF USRPRF(name) and look at Sign-on attempts not valid, Status and Date password last changed. A count close to the QMAXSIGN value means the next failure will trigger the lockout action.
3. Check QMAXSIGN and QMAXSGNACN with WRKSYSVAL QMAXSIGN and WRKSYSVAL QMAXSGNACN so you know what happens on the next failure.
4. If security auditing includes *AUTFAIL, failed sign-ons are written to the QAUDJRN audit journal as PW entries. These show which device or server the attempts came from, which helps when a client is retrying on its own.
5. Look in QSYSOPR (or QSYSMSG if it exists) for CPF1393 or CPF1397. Either one means the limit has already been reached.

How to fix it

• Type the password again slowly, with Caps Lock off. If the system is at QPWDLVL 2 or 3, match upper and lower case exactly.
• Test the keyboard by typing the password into the user ID field where you can see it, then clear it. If the characters change, fix the emulator's keyboard mapping.
• If you aren't sure of the password, stop trying and ask for a reset. An administrator can run CHGUSRPRF USRPRF(name) PASSWORD(temp) PWDEXP(*YES) so the user has to choose a new password at the next sign-on.
• If the profile is already disabled, the administrator also needs STATUS(*ENABLED) on the same command.
• Update or delete saved passwords in PC clients, scheduled scripts and connection definitions after any password change.

DSPMSGD MSGID(CPF1107) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.