# CPF1110: Not authorized to work station

Source: https://wndsoftware.com/mainframe-errors/cpf1110

### CPF1110: Not authorized to work station

CPF1110 means the user profile isn't authorized to the display device (work station) used for the sign-on. The system checks authority to the device description, and without it the sign-on is refused.


#### Other names for this code

Also written as `MSGCPF1110`, `CPF1110 not authorized to work station`, `not authorized to workstation AS400`, `iSeries CPF1110`, `IBM i not authorized to device`, `QLMTSECOFR CPF1110`.


### What it means

Every 5250 session runs on a display device, which has a device description object (type *DEVD) in QSYS. Like any object, a device description has authorities. To sign on at a display, a user needs *CHANGE authority to its device description.

Most devices give *PUBLIC *CHANGE, so ordinary users never notice the check. Two situations make it bite. A site may secure certain devices, such as the console or a named device in a secure area, by setting *PUBLIC to *EXCLUDE. More often, the system value QLMTSECOFR is set to 1. Then *PUBLIC authority to a device doesn't count for any user with *ALLOBJ or *SERVICE special authority. Those users need their own explicit authority to the device. That's why security officers and administrators see CPF1110 on a new emulator session while ordinary users sign on fine.

The failure counts as a sign-on attempt that wasn't valid. Repeated tries add toward the QMAXSIGN limit.


### Common causes

- QLMTSECOFR is 1 and the user has *ALLOBJ or *SERVICE special authority but no private authority to this device.
- The device description has *PUBLIC *EXCLUDE, and the user hasn't been granted authority to it.
- The emulator connects with a specific device name (a named session) that has been secured, instead of an automatically created QPADEV device.


### How to find the problem

- Note the device name shown in the top right of the sign-on display, or in the emulator's session settings.
- An administrator can run `DSPOBJAUT OBJ(device) OBJTYPE(*DEVD)` to see who has authority to it, including *PUBLIC.
- Check `WRKSYSVAL QLMTSECOFR`. If it's 1, compare with the user's special authorities from `DSPUSRPRF USRPRF(name)`.
- Look for CPF1397 or CPF1393 in QSYSOPR if the user kept trying, because these failures count toward the sign-on limit.


### How to fix it

- Grant the user authority to the device with `GRTOBJAUT OBJ(device) OBJTYPE(*DEVD) USER(name) AUT(*CHANGE)`. Some sites grant *ALL to their security officers.
- For administrators who sign on from many virtual devices, grant authority to the devices they use, or give them a named device in the emulator that has been authorized.
- Setting QLMTSECOFR to 0 removes the check for powerful users, but IBM recommends keeping it at 1. Make that a security decision, not a quick fix.
- Use a different, authorized display in the meantime.


### IBM documentation

[IBM Display Message Descriptions (DSPMSGD)](https://www.ibm.com/docs/en/i/7.5.0?topic=ssw_ibm_i_75/cl/dspmsgd.htm). Use the documentation for your installed release.

This link opens the relevant IBM reference library or lookup instructions. Match the complete code and your installed product release; it is not a code-specific review.

Read the installed message description:


```text
DSPMSGD MSGID(CPF1110) MSGF(QSYS/QCPFMSG)
```

Also inspect the full job log and second-level message text, including substitution values.

[Report a correction to WND Software](https://wndsoftware.com/contact#message).

Technical reviewer: [Albert Joseph](https://wndsoftware.com/authors/albert-joseph), WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.


### Related codes

[CPF1116 Next not valid sign-on attempt varies off device Read →](https://wndsoftware.com/mainframe-errors/cpf1116)
[CPF1393 User profile disabled after too many sign-on attempts Read →](https://wndsoftware.com/mainframe-errors/cpf1393)
[CPF1394 User profile cannot sign on Read →](https://wndsoftware.com/mainframe-errors/cpf1394)
[CPF1107 Password not correct for user profile Read →](https://wndsoftware.com/mainframe-errors/cpf1107)
[CPF2207 Not authorized to use object Read →](https://wndsoftware.com/mainframe-errors/cpf2207)

### Questions


#### Why can ordinary users sign on at this display but I can't?

Most likely QLMTSECOFR is 1 and your profile has *ALLOBJ or *SERVICE. Then public authority to the device doesn't count for you, and you need your own authority to it.


#### Does CPF1110 count toward locking my profile?

It counts as a sign-on attempt that wasn't valid, so repeated tries can reach the QMAXSIGN limit and trigger the QMAXSGNACN action.


#### What authority do I need to the device?

*CHANGE authority to the device description is the usual requirement. Some sites grant *ALL to security officers.

[IBM i CPF, MCH and RPG messages](https://wndsoftware.com/mainframe-errors/ibm-i-messages) · [CPF1107](https://wndsoftware.com/mainframe-errors/cpf1107) · [CPF1116](https://wndsoftware.com/mainframe-errors/cpf1116)

[← All error codes](https://wndsoftware.com/mainframe-errors/)