Today I had a really unfortunate situation occur. My security automation software (in-house written)
set the CANCEL or SUSPEND bit on over 5000 logonids - how can I issue a simple command to remove cancel or suspend from just those logonids
that were cancelled or suspended today?
The following command can be issued to ACF2 to remove the SUSPEND attribute.
CHANGE UID(-) IF(CSDATE eq d'12/25/15' and suspend) nosuspend
CHANGE UID(-) IF(CSDATE eq d'12/25/15' and cancel) nocancel
The first command will remove SUSPEND - but only if it was set on December 25th 2015
The second command will remove CANCEL - but only if it was set on December 25th 2015
if you just want to remove any specific attribute from all logonids that currently have the attribute, the command could be issued as...
CHANGE UID(-) IF(cancel) nocancel