CPF1392: Next not valid sign-on disables user profile
CPF1392 is a warning on the IBM i sign-on display. Your user profile has had enough failed sign-on attempts that one more will reach the QMAXSIGN limit, and the system will disable the profile.
Other names for this code
Also written as MSGCPF1392, CPF1392 disables user profile, next not valid sign-on disables user profile, AS400 profile will be disabled, iSeries CPF1392.
What it means
Every user profile has a count of sign-on attempts that weren't valid. Each wrong password adds one, and one good sign-on or password check sets it back to zero. When the count reaches the QMAXSIGN system value, the system takes the action set in QMAXSGNACN. With value 2 (disable the user) or 3 (disable the user and the device, the shipped default), the profile's status is changed to *DISABLED.
CPF1392 is the last warning before that. Unlike the device count behind CPF1116, the profile count doesn't care where the failures came from. Wrong passwords from a 5250 session, an ODBC connection, FTP or a file share can all add to it. That's why a user can see CPF1392 on the first try of the morning.
If the next attempt fails too, the profile is disabled, the user gets CPF1394 on later tries, and CPF1393 goes to QSYSOPR (and QSYSMSG if it exists).
Common causes
- The user typed the wrong password several times.
- A PC client, mapped drive, scheduled transfer or ODBC data source kept trying an old password after it was changed. These failures add up without the user seeing them.
- Someone else tried to sign on with this user ID.
- A low QMAXSIGN value, such as 2, leaves almost no room for mistakes.
How to find the problem
- An administrator can run
DSPUSRPRF USRPRF(name)and read Sign-on attempts not valid. - To see where the failures came from, look in the QAUDJRN audit journal for PW entries if *AUTFAIL auditing is on. The entry shows the job, device or remote address.
- Look in QSYSOPR and the history log for earlier CPF1393 messages for the same profile. A pattern often points to a server job such as one in QUSRWRK or QSERVER.
- Check QMAXSIGN and QMAXSGNACN with
WRKSYSVAL.
How to fix it
- Don't try again until you're sure of the password. Ask the help desk for a reset if you're not.
- An administrator can reset the password and require a change at next sign-on with
CHGUSRPRF USRPRF(name) PASSWORD(temp) PWDEXP(*YES). - Find and update any saved passwords in PC tools, drive mappings and scripts, or the profile will keep getting close to the limit.
- If the profile has already been disabled, enable it with
CHGUSRPRF USRPRF(name) STATUS(*ENABLED).
IBM documentation
IBM Display Message Descriptions (DSPMSGD). Use the documentation for your installed release.
This link opens the relevant IBM reference library or lookup instructions. Match the complete code and your installed product release; it is not a code-specific review.
Read the installed message description:
DSPMSGD MSGID(CPF1392) MSGF(QSYS/QCPFMSG)
Also inspect the full job log and second-level message text, including substitution values.
Related codes
Questions
Why do I see CPF1392 when I haven't typed a wrong password?
Failures from other connections count against the same profile. An ODBC connection, mapped drive or script using an old password is the usual cause.
Does CPF1392 mean my profile is disabled?
Not yet. It means one more failure will disable it. If you already see CPF1394, the profile is disabled.
How do I reset the failed sign-on count?
A successful sign-on or password check resets it to zero. Changing the password with CHGUSRPRF doesn't by itself re-enable a profile that is already disabled.