Jeff, Here are a few more things to consider. Did you check SMF records for ALU REVOKE commands and for all logon events related to the ID? There may be records other than just passwords violations that could help explain this event. Do you have any RACF exits that might effect it? Also, do you have a database unload from just before the time when it became revoked to see if there was a REVOKE(date) on the ID?
Regards, Bob -----Original Message----- Date: Fri, 26 May 2006 12:03:48 -0500 From: =?iso-8859-1?Q?Jeff_Ruegsegger?= <[EMAIL PROTECTED]> Subject: RACF user id revocation We had a RACF userid for one of our STC's get revoked this week. I've since made it a PROTECTED user. I can't seem to find out how/who/when/where the ID got revoked. No msgs in SYSLOG, RAN SYNCTOOL reports (pw violations and ALU PW Commands) and can't find out what happened. I have just opened an issue with IBM but was wondering if anyone could point me somewhere I havn't already been. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
