CPF1393: User profile disabled after too many sign-on attempts

What it means

When failed attempts for a profile reach the QMAXSIGN value, and QMAXSGNACN is set to 2 or 3, the system changes the profile's status to *DISABLED. It then sends CPF1393 to the QSYSOPR message queue, and to QSYSMSG too if you've created that queue in QSYS. The user doesn't see CPF1393. The user sees CPF1394 the next time they try to sign on.

The message tells you who was disabled and where the last attempt came from. If a device name is shown, the failures came from an interactive session or a communications device. If no device is shown and the subsystem is QSYSWRK, QUSRWRK or QSERVER, a server job disabled the profile. That usually means a PC client was sending a wrong password, often retrying on its own.

A profile can also be disabled by hand with CHGUSRPRF. That doesn't send CPF1393.

Common causes

• A user typed the wrong password too many times on the sign-on display.
• A PC client, ODBC or JDBC data source, FTP script or mapped drive kept sending an old password after a change.
• A client that retries automatically used up the allowed attempts in seconds.
• Someone tried to guess the password for the profile.

How to find the problem

1. Display QSYSOPR with DSPMSG QSYSOPR, or QSYSMSG if you have it. Put the cursor on CPF1393 and press F1 to see the profile, device and subsystem.
2. From the help screen, press F9 for message details. It shows the job that sent the message. A server job name such as QZDASOINIT (database server) or QZLSFILE (file server) tells you which kind of client caused it.
3. Search the history log with DSPLOG LOG(QHST) MSGID(CPF1393) to see how often it happens and for which profiles.
4. If *AUTFAIL auditing is on, PW entries in QAUDJRN show each failed attempt with its source.
5. DSPUSRPRF USRPRF(name) shows the profile's current status and its count of attempts that weren't valid.

How to fix it

• Confirm with the user that the failures were theirs. If not, treat it as a security event.
• Re-enable the profile with CHGUSRPRF USRPRF(name) STATUS(*ENABLED). Reset the password at the same time if the user has forgotten it, adding PWDEXP(*YES) to force a change at sign-on.
• Fix the client that sent the bad password before you re-enable, or it will disable the profile again within minutes.
• Create QSYSMSG in QSYS (CRTMSGQ QSYS/QSYSMSG) if you don't have it, so critical security messages don't get lost in QSYSOPR.

DSPMSGD MSGID(CPF1393) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.