CPF22E4: Password for user profile has expired

What it means

IBM i passwords can expire. The system value QPWDEXPITV sets a system-wide interval in days, and each profile's PWDEXPITV can override it. An administrator can also mark a password as expired straight away with PWDEXP(*YES), which is common after a reset.

On the sign-on display an expired password isn't a dead end. The system tells the user and asks for a new password. Programs and servers can't do that. When they call the Get Profile Handle API (QSYGETPH) or a related API with an expired password, the API ends with CPF22E4 and the work doesn't run. Called with *NOPWD, the API also refuses a profile whose password has expired. With *NOPWDSTS or *NOPWDCHK, a caller with *ALLOBJ and *SECADM can still get a handle.

That's why CPF22E4 often shows up for service accounts. A profile used only by a file transfer, a data source or an application connection never signs on interactively, so nobody gets the prompt to change the password.

Common causes

• The profile's password is older than the expiration interval set by QPWDEXPITV or the profile's PWDEXPITV.
• An administrator reset the password with PWDEXP(*YES), and the user hasn't signed on interactively to choose a new one.
• A service or application profile has an expiring password and nobody owns changing it.

How to find the problem

1. Look in the failing job's log with DSPJOBLOG for CPF22E4 and the profile name.
2. Run DSPUSRPRF USRPRF(name). Check Date password last changed, Password expiration interval and Set password to expired.
3. Check the system-wide interval with WRKSYSVAL QPWDEXPITV.
4. For many profiles at once, query the QSYS2.USER_INFO view for the password expiration date and interval.

How to fix it

• Have the owner sign on interactively once and change the password when prompted, or run CHGPWD.
• An administrator can set a new password with CHGUSRPRF USRPRF(name) PASSWORD(newpw) PWDEXP(*NO). Then update every client or script that uses it.
• For service profiles, agree a process for rotating the password before it expires. Setting PWDEXPITV(*NOMAX) stops expiry but may break your security policy, so check first.
• After the fix, test the failing connection once. Repeated failures can disable the profile.

DSPMSGD MSGID(CPF22E4) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.