I have a lot of logonids that were either cancelled or suspended erroneously today by my automation software. How can I unsuspend or uncancel them all.

book

Article ID: 36224

calendar_today

Updated On:

Products

CA ACF2 CA ACF2 - DB2 Option CA ACF2 for zVM CA ACF2 - z/OS CA ACF2 - MISC CA PanApt CA PanAudit

Issue/Introduction

Introduction:

 

Today I had a really unfortunate situation occur. My security automation software (in-house written)

set the CANCEL or SUSPEND bit on over 5000 logonids - how can I issue a simple command to remove cancel or suspend from just those logonids

that were cancelled or suspended today?

 

Instructions: 

 

The following command can be issued to ACF2 to remove the SUSPEND attribute.

ACF

SET LID

CHANGE UID(-)  IF(CSDATE eq d'12/25/15' and suspend) nosuspend 

CHANGE UID(-)  IF(CSDATE eq d'12/25/15' and cancel) nocancel

END

 

The first command will remove SUSPEND - but only if it was set on December 25th 2015

The second command will remove CANCEL - but only if it was set on December 25th 2015

 

if you just want to remove any specific attribute from all logonids that currently have  the attribute, the command could be issued as...

CHANGE UID(-)  IF(cancel) nocancel

 

 

 

Environment

Release:
Component: ACF2MS