Why is the Control Compliance Suite Message Based Module for Sybase modules not changing the password as expected?

Products

• Control Compliance Suite Exchange

Issue/Introduction

The documentation for the Control Compliance Suite (CCS) Message Based Content (MBC) for Sybase modules is not correct with the ‘config PassChangedPeriod’ parameter in the esmsybaseenv.dat file.

Cause

The MBC for Sybase documentation for the 'PassChangedPeriod' parameter is incorrect.
 
This is how the 'PassChangedPeriod' parameter really works:
During the policy run the Sybase module will take the 'PassChangedPeriod' value in the esmsybaseenv.dat file and compare it to the 'Password expiration interval' value of the SYMESMDBA account, and it will subtract the value listed for the 'PassChangedPeriod' from the value listed in the 'Password expiration interval' of the SYMESMDBA account, and the result is when the password will be changed.
 
For example:
If on the agent the esmsybaseenv.dat has the following set:
config PassChangedPeriod 15
 
and on the SYMESMDBA account it has the following set:
Password expiration interval: 90
 
the password for SYMESMDBA account will be changed every 75 days (90-15=75)
 
By default, if the 'config PassChangedPeriod' is not in the esmsybaseenv.dat file, and the SYMESMDBA has the 'Password expiration interval: 90', the Sybase modules will change the password for the SYMESMDBA account every 55 days (90-35=55).
 
NOTE:
The examples above are assuming that all the SYMESMDBA accounts have the 'Password expiration interval' set at 90.  If the Password expiration interval varies, for example set at 30, and nothing is set in the esmsybaseenv.dat file (so it is set to 35 by default), the Sybase modules will change the password every policy run (30-35=-5, which means every policy run).  If the 'Password expiration interval' set at 30, and the 'config PassChangedPeriod' is set to 30, then the Sybase modules will change the password every policy run.
 

Resolution

Enter the value for the ‘config PassChangedPeriod’ based with the knowledge that the value will be subtracted from the ‘Password expiration interval’ of the SYMESMDBA account, and the result is when the password will be changed.