I have a lot of logonids that were either cancelled or suspended erroneously today by my automation software. How can I unsuspend or uncancel them all

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

Security automation software (in-house written) set the CANCEL or SUSPEND bit on over 5000 logonids - how to remove cancel or suspend from just those logonids that were cancelled or suspended today?

 

 

 

 

Environment

Release:
Component: ACF2MS

Resolution

The following command can be issued to ACF2 to remove the SUSPEND attribute.

ACF

SET LID

CHANGE UID(-)  IF(CSDATE eq d'12/25/15' and suspend) nosuspend 

CHANGE UID(-)  IF(CSDATE eq d'12/25/15' and cancel) nocancel

END

 

The first command will remove SUSPEND - but only if it was set on December 25th 2015

The second command will remove CANCEL - but only if it was set on December 25th 2015

 

if you just want to remove any specific attribute from all logonids that currently have  the attribute, the command could be issued as...

CHANGE UID(-)  IF(cancel) nocancel