Managing Directory Entries › Managing Inactive Directory Entries

Previous Topic: Checking User ID Password Expiration

Next Topic: Expiring a Password Automatically

Managing Inactive Directory Entries

An inactive user ID is a user ID that a user has not logged on in a specified amount of time. The AUTOEXP record determines the amount of time. The actual time over which a user has not logged on, or changed passwords, is tracked through its *LA=, *LL=, and *PW= special comments. CA VM:Secure provides a number of tools to help you identify and manage inactive user IDs.

Consider the following to manage inactive userids:

  1. Expire logon passwords automatically after a known amount of time.

    Doing so enables you to easily spot those user IDs that have not logged on in a while. For example, if you expire logon passwords after 90 days of inactivity, you can use the ULIST command to show the user IDs whose passwords are expired and when their passwords were last changed. A user ID whose password is expired and whose password was last changed 185 days ago has been inactive for a long time.

    For CA VM:Director or CA VM:Secure without the Rules Facility installed, you can use an IPLDISK procedure to expire passwords automatically.

    (CA VM:Secure only) You can use the Rules Facility or an IPLDISK procedure to expire passwords automatically.

  2. Decide how long user IDs must remain unused to be considered inactive.
  3. (CA VM:Secure only) Monitor user IDs that are autolog–only. Keep in mind that the absence of normal logons to a user ID is not a true indicator of inactive user IDs. Your site may have a number of user IDs that are autolog–only. The *LA= special comment in a directory entry can help you track these user IDs.
  4. Define stages of inactivity and decide what will happen to user IDs at each stage of inactivity.

    For example, you can disable user IDs that have not logged on for four weeks. You can put on hold user IDs that have been inactive for at least four weeks, and if they remain inactive for the next six months, you may want to delete them.

Note: For information about the special comments, see the chapter Special Comment Reference.