CPF22E3: User profile is disabled

What it means

Programs and server jobs that run work as another user call the Get Profile Handle API (QSYGETPH) or a related API. The API checks the profile first. If its status is *DISABLED, the API ends with CPF22E3 and no handle is returned. The program can't switch to that user.

How strict the check is depends on how the API is called. With the special value *NOPWD, a disabled profile is always refused. With *NOPWDCHK, a caller that has both *ALLOBJ and *SECADM special authority can still get a handle for a disabled profile. With *NOPWDSTS, a disabled profile is refused too.

A profile becomes disabled when failed sign-on or password attempts reach QMAXSIGN, or when an administrator or a tool disables it on purpose. IBM has documented a case where a product's administration functions failed with CPF22E3 because the site had disabled QSECOFR, which the product relied on. Disabling powerful IBM profiles is common practice, so check whether any product depends on them before you do it.

Common causes

• The profile was disabled after too many failed passwords. CPF1393 in QSYSOPR confirms this.
• An administrator disabled the profile, for example during a leaver process or a security hardening project.
• A product or job swaps to an IBM-supplied profile, such as QSECOFR, that the site has disabled.
• The profile reached its user expiration date and the expiration action disabled it.

How to find the problem

1. Open the job log of the failing job with DSPJOBLOG and note the profile named in CPF22E3.
2. Run DSPUSRPRF USRPRF(name) to see the status, the count of attempts that weren't valid and the expiration fields.
3. Search for CPF1393 with DSPLOG LOG(QHST) MSGID(CPF1393). If it's there, the system disabled the profile and the message says where the failures came from.
4. If there's no CPF1393, a person or tool disabled it. A CP entry in QAUDJRN shows who changed the profile, if that auditing is on.

How to fix it

• Enable the profile with CHGUSRPRF USRPRF(name) STATUS(*ENABLED), after fixing whatever caused failed passwords.
• If the profile was disabled on purpose, change the job or product to run under a profile that is meant to be active, rather than enabling it.
• For a product that needs an IBM-supplied profile, check the product's documentation for a supported alternative before enabling a powerful profile again.
• If expiration caused it, set a new expiration date or interval before enabling it.

DSPMSGD MSGID(CPF22E3) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.