IBM Support

IBM i User Profile Analysis Using QSYS2.USER_INFO

How To


Summary

IBM i User Profile Analysis Using QSYS2.USER_INFO explains how IBM i security administrators can use SQL services to audit and analyze user profiles across the system.

The document focuses on the QSYS2.USER_INFO view, which provides detailed information about all user profiles defined on an IBM i partition. By combining this view with related services such as QSYS2.GROUP_PROFILE_ENTRIES and SYSTOOLS.AUDIT_JOURNAL_CP, administrators can perform comprehensive security reviews directly through SQL, eliminating the need for traditional green-screen commands and manual profile inspections.

Environment

IBM i versions 7.5 and above 

Note: Some sample SQL statements may also run on earlier IBM i releases. When a query is supported on a release prior to IBM i 7.5, the minimum supported release is identified in the query description by the minvrm attribute. This value indicates the earliest IBM i version and release on which the SQL statement is expected to work.

Steps

Overview

QSYS2.USER_INFO is a system-provided SQL view that exposes detailed information about every user profile defined on the IBM i system. Combined with related views such as QSYS2.GROUP_PROFILE_ENTRIES and SYSTOOLS.AUDIT_JOURNAL_CP, it enables security administrators to perform comprehensive user profile audits entirely in SQL — without requiring green-screen commands or manual profile reviews.

This document provides a set of targeted SQL queries designed to surface security risks in user profile configurations. Each query focuses on a specific risk area and includes risk classification, a description of why the condition is significant, and recommended remediation guidance.

Table of Contents

  1. Key Columns in QSYS2.USER_INFO
  2. Users with Non-Expiring Passwords
  3. Users with Special Authorities (*ALLOBJ)
  4. All Special Authorities by Profile
  5. Recently Created User Profiles
  6. User Profile Changes Cross-Referenced with Audit Journal
  7. Profiles with Default or Known Passwords
  8. Inactive User Profiles
  9. Profiles with Unlimited Sign-On Attempts
  10. Service Accounts and System Profiles Review
  11. Group Profile Membership Summary
  12. Consolidated Risk Summary
  13. Related IBM i Services
  14. References

Key Columns in QSYS2.USER_INFO

The following columns are referenced throughout this document.

ColumnDescription
AUTHORIZATION_NAMEThe user profile name
STATUS*ENABLED or *DISABLED
NO_PASSWORD_INDICATOR'YES' = no password set (used for service/batch accounts)
PASSWORD_EXPIRATION_INTERVALSMALLINT: days until expiry; -1 = never expires (*NOMAX); 0 = use QPWDEXPITV
DAYS_UNTIL_PASSWORD_EXPIRESComputed days; NULL when password will not expire
PREVIOUS_SIGNONTimestamp of the last successful sign-on; NULL if never signed on
SIGN_ON_ATTEMPTS_NOT_VALIDConsecutive failed sign-on attempts since last success
MAXIMUM_SIGN_ON_ATTEMPTSVARCHAR(7): 1–25 = explicit limit per-profile; *SYSVAL = defer to QMAXSIGN system value
SPECIAL_AUTHORITIESBlank-separated string of granted special authorities
GROUP_PROFILE_NAMEPrimary group profile
SUPPLEMENTAL_GROUP_LISTAdditional group memberships
TEXT_DESCRIPTIONFree-text description field
USER_CLASS_NAME*SECOFR, *PGMR, *SYSOPR, *USER, etc.
PASSWORD_CHANGE_DATETimestamp the password was last changed (PWDCHGDAT)
USER_EXPIRATION_DATETimestamp the profile itself expires; NULL = never (USREXPDATE)
CREATION_TIMESTAMPTimestamp when the profile was created
LAST_USED_TIMESTAMPDate the profile was last used; time portion is always 0 (LASTUSED)
LIMIT_CAPABILITIESWhether the user can change their environment
HOME_DIRECTORYIFS home directory path
LOCALE_JOB_ATTRIBUTESLocale settings

1. Users with Non-Expiring Passwords

⚠ Risk Level: HIGH

User profiles configured with PASSWORD_EXPIRATION_INTERVAL = -1 (the numeric value that represents *NOMAX) are exempt from the system-wide password expiration policy. This is appropriate for certain service accounts but should not apply to interactive users. Stale passwords on interactive accounts represent a persistent credential exposure risk.

SQL

--  category:  IBM i Services
--  description:  Security - User profiles with non-expiring passwords
--
-- Identifies all enabled user profiles where the password never expires.
-- Profiles with PASSWORD_EXPIRATION_INTERVAL = *NOMAX bypass the system
-- password expiration policy (QPWDEXPITV). Review these profiles to ensure
-- only appropriate service/batch accounts carry this setting.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.USER_CLASS_NAME,
    u.NO_PASSWORD_INDICATOR,
    CASE u.PASSWORD_EXPIRATION_INTERVAL
        WHEN -1 THEN '*NOMAX'
        WHEN  0 THEN '*SYSVAL'
        ELSE CHAR(u.PASSWORD_EXPIRATION_INTERVAL)
    END AS PASSWORD_EXPIRATION_INTERVAL,
    u.PASSWORD_CHANGE_DATE,
    CASE WHEN u.PASSWORD_CHANGE_DATE IS NULL THEN 99999
         ELSE DAYS(CURRENT_DATE) - DAYS(DATE(u.PASSWORD_CHANGE_DATE))
    END AS DAYS_SINCE_PASSWORD_CHANGE,
    u.PREVIOUS_SIGNON,
    u.GROUP_PROFILE_NAME,
    u.SPECIAL_AUTHORITIES,
    u.TEXT_DESCRIPTION
FROM QSYS2.USER_INFO u
WHERE u.PASSWORD_EXPIRATION_INTERVAL = -1        -- -1 = *NOMAX (never expires)
  AND u.STATUS                        = '*ENABLED'
  AND u.NO_PASSWORD_INDICATOR         = 'NO'
ORDER BY DAYS_SINCE_PASSWORD_CHANGE DESC,
         u.AUTHORIZATION_NAME
WITH UR;

 

Sample Output

AUTHORIZATION_NAMESTATUSUSER_CLASS_NAMENO_PASSWORD_INDICATORPASSWORD_EXPIRATION_INTERVALPASSWORD_CHANGE_DATEDAYS_SINCE_CHANGEPREVIOUS_SIGNONGROUP_PROFILE_NAMESPECIAL_AUTHORITIESTEXT_DESCRIPTION
JSMITH*ENABLED*PGMRNO*NOMAX2021-03-1413032025-10-01 08:42:11DEVTEAM*NONEJane Smith - Development
DBADMIN*ENABLED*SECOFRNO*NOMAX2022-11-306962025-09-28 14:05:33*NONE*ALLOBJ *SECADMDatabase Administrator
SVCBATCH*ENABLED*USERNO*NOMAX2023-06-014932025-08-15 02:00:00BATCHGRP*JOBCTLNightly batch service
RLOPEZ*ENABLED*PGMRNO*NOMAX2024-01-102702025-09-30 09:17:44DEVTEAM*NONERicardo Lopez - Development
APPADMIN*ENABLED*SYSOPRNO*NOMAX2024-08-22462025-10-06 11:30:09OPSGRP*JOBCTL *SPLCTLApplication Admin
Note: Sample data is illustrative only. DAYS_SINCE_PASSWORD_CHANGE values are relative to run date 2025-10-07. A value of 9999 indicates PASSWORD_CHANGE_DATE is NULL.

Interpretation

  • Profiles where NO_PASSWORD_INDICATOR = 'NO' and PASSWORD_EXPIRATION_INTERVAL = -1 are interactive accounts that will never be prompted to change their password.
  • High DAYS_SINCE_PASSWORD_CHANGE values (> 365) indicate credentials that have been static for an extended period.
  • NO_PASSWORD_INDICATOR = 'YES' accounts are legitimate service accounts using token or certificate authentication and are excluded.

Recommended Actions

  • Set PASSWORD_EXPIRATION_INTERVAL to a value aligned with policy (typically 30–90 days) for all interactive accounts.
  • Use CHGUSRPRF USRPRF(<name>) PWDEXPITV(<days>) to correct non-compliant profiles.
  • Document any exceptions where *NOMAX (-1) is legitimately required.

2. Users with Special Authorities (*ALLOBJ)

⚠ Risk Level: CRITICAL

Profiles that hold *ALLOBJ special authority — directly assigned or inherited through a group profile — can access any object on the system regardless of object-level permissions. This is among the most powerful authorities in IBM i and must be strictly limited to named administrators.

SQL

--  category:  IBM i Services
--  description:  Security - Profiles with *ALLOBJ directly or via group profile
--  minvrm:  v7r3m0
 
--
-- Returns all user profiles that have *ALLOBJ special authority either:
--   (a) assigned directly to the profile, OR
--   (b) inherited because their primary group profile holds *ALLOBJ.
-- Both conditions are equally dangerous and must be reviewed.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.NO_PASSWORD_INDICATOR,
    u.PREVIOUS_SIGNON,
    u.SPECIAL_AUTHORITIES,
    u.GROUP_PROFILE_NAME,
    u.USER_CLASS_NAME,
    u.TEXT_DESCRIPTION,
    CASE
        WHEN u.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
            THEN 'DIRECT'
        ELSE 'VIA GROUP PROFILE'
    END AS ALLOBJ_SOURCE
FROM QSYS2.USER_INFO u
WHERE u.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
 
UNION
 
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.NO_PASSWORD_INDICATOR,
    u.PREVIOUS_SIGNON,
    u.SPECIAL_AUTHORITIES,
    u.GROUP_PROFILE_NAME,
    u.USER_CLASS_NAME,
    u.TEXT_DESCRIPTION,
    'VIA GROUP PROFILE' AS ALLOBJ_SOURCE
FROM QSYS2.USER_INFO u
WHERE u.AUTHORIZATION_NAME IN (
    SELECT gpe.USER_PROFILE_NAME
    FROM QSYS2.GROUP_PROFILE_ENTRIES gpe
    WHERE gpe.GROUP_PROFILE_NAME IN (
        SELECT g.AUTHORIZATION_NAME
        FROM QSYS2.USER_INFO g
        WHERE g.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
    )
)
AND u.SPECIAL_AUTHORITIES NOT LIKE '%*ALLOBJ%'
 
ORDER BY ALLOBJ_SOURCE, AUTHORIZATION_NAME
WITH UR;

Sample Output

AUTHORIZATION_NAMESTATUSNO_PASSWORD_INDICATORPREVIOUS_SIGNONSPECIAL_AUTHORITIESGROUP_PROFILE_NAMEUSER_CLASS_NAMETEXT_DESCRIPTIONALLOBJ_SOURCE
DBADMIN*ENABLEDNO2025-09-28 14:05:33*ALLOBJ *SECADM*NONE*SECOFRDatabase AdministratorDIRECT
QSECOFR*ENABLEDNO2025-10-06 22:14:05*ALLOBJ *SECADM *JOBCTL *SPLCTL *SAVSYS *SERVICE *AUDIT *IOSYSCFG*NONE*SECOFRSecurity OfficerDIRECT
SVCAPI*ENABLEDYES2025-10-01 02:00:00*ALLOBJ *JOBCTL*NONE*USERAPI Integration ServiceDIRECT
JSMITH*ENABLEDNO2025-10-01 08:42:11*NONEPOWERGRP*PGMRJane Smith - DevelopmentVIA GROUP PROFILE
RLOPEZ*ENABLEDNO2025-09-30 09:17:44*NONEPOWERGRP*PGMRRicardo Lopez - DevelopmentVIA GROUP PROFILE
Note: SVCAPI is a service account (NO_PASSWORD_INDICATOR = YES) holding *ALLOBJ directly — requires documented justification. JSMITH and RLOPEZ have no direct special authorities but inherit *ALLOBJ through POWERGRP.

Interpretation

  • DIRECT — the profile was explicitly granted *ALLOBJ.
  • VIA GROUP PROFILE — the profile does not hold *ALLOBJ directly but is a member of a group that does.
  • Profiles with STATUS = '*DISABLED' are lower immediate risk but should still be cleaned up.
  • Profiles with NO_PASSWORD_INDICATOR = 'YES' that have *ALLOBJ are service accounts with full system authority — heightened scrutiny required.

Recommended Actions

  • Confirm each listed profile has a documented business justification for *ALLOBJ.
  • Remove *ALLOBJ from any profile that does not require it: CHGUSRPRF USRPRF(<name>) SPCAUT(*USRCLS).
  • Enforce dual-control for sign-on of *ALLOBJ accounts.

3. All Special Authorities by Profile

⚠ Risk Level: HIGH

Beyond *ALLOBJ, IBM i has several other special authorities that grant significant system-level access. This query provides a full inventory of all profiles holding any special authority.

Special Authorities Reference

AuthorityDescription
*ALLOBJAccess to all objects on the system
*SECADMManage user profiles and security
*JOBCTLControl jobs and subsystems
*SPLCTLControl spool files of any user
*SAVSYSSave and restore the system
*SERVICEPerform hardware service functions
*AUDITManage audit journal settings
*IOSYSCFGConfigure I/O and communications

SQL

--  category:  IBM i Services
--  description:  Security - Full inventory of special authority assignments
--  minvrm:  v7r3m0
 
--
-- Full inventory of user profiles holding any IBM i special authority.
-- Results include the raw SPECIAL_AUTHORITIES string and individual
-- flags for each authority to facilitate filtering and sorting.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.USER_CLASS_NAME,
    u.SPECIAL_AUTHORITIES,
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'   THEN 'YES' ELSE 'NO' END AS HAS_ALLOBJ,
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*SECADM%'   THEN 'YES' ELSE 'NO' END AS HAS_SECADM,
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*JOBCTL%'   THEN 'YES' ELSE 'NO' END AS HAS_JOBCTL,
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*SPLCTL%'   THEN 'YES' ELSE 'NO' END AS HAS_SPLCTL,
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*SAVSYS%'   THEN 'YES' ELSE 'NO' END AS HAS_SAVSYS,
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*SERVICE%'  THEN 'YES' ELSE 'NO' END AS HAS_SERVICE,
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*AUDIT%'    THEN 'YES' ELSE 'NO' END AS HAS_AUDIT,
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*IOSYSCFG%' THEN 'YES' ELSE 'NO' END AS HAS_IOSYSCFG,
    u.PREVIOUS_SIGNON,
    u.TEXT_DESCRIPTION
FROM QSYS2.USER_INFO u
WHERE u.SPECIAL_AUTHORITIES IS NOT NULL
  AND u.SPECIAL_AUTHORITIES <> ''
  AND u.SPECIAL_AUTHORITIES <> '*NONE'
ORDER BY u.STATUS DESC,
         u.AUTHORIZATION_NAME
WITH UR;

Recommended Actions

  • Compare results against an approved privileged-user inventory.
  • Investigate any profiles not in the approved list and remove authorities not needed.
  • Pay particular attention to *SECADM (can create/modify other users) and *AUDIT (can disable auditing).

4. Recently Created User Profiles

ⓘ Risk Level: MEDIUM

QSYS2.USER_INFO does not expose a "last modified" timestamp for profile changes — that information lives exclusively in the security audit journal (see Query 5). However, the view does provide CREATION_TIMESTAMP, which reliably identifies newly provisioned profiles.

SQL

--  category:  IBM i Services
--  description:  Security - User profiles created recently
--  minvrm:  v7r3m0
 
--
-- Returns user profiles whose CREATION_TIMESTAMP falls within the last 30 days.
-- Newly created profiles should be reviewed to confirm they are authorized,
-- correctly configured, and comply with the least-privilege principle.
-- Adjust the interval to match your change-review cadence.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.USER_CLASS_NAME,
    u.CREATION_TIMESTAMP,
    DAYS(CURRENT_DATE) - DAYS(DATE(u.CREATION_TIMESTAMP)) AS DAYS_SINCE_CREATION,
    u.USER_CREATOR,
    u.SPECIAL_AUTHORITIES,
    u.GROUP_PROFILE_NAME,
    u.NO_PASSWORD_INDICATOR,
    u.PASSWORD_EXPIRATION_INTERVAL,
    u.USER_EXPIRATION_DATE,
    u.TEXT_DESCRIPTION
FROM QSYS2.USER_INFO u
WHERE u.CREATION_TIMESTAMP >= CURRENT TIMESTAMP - 30 DAYS
ORDER BY u.CREATION_TIMESTAMP DESC,
         u.AUTHORIZATION_NAME
WITH UR;

Sample Output

AUTHORIZATION_NAMESTATUSUSER_CLASS_NAMECREATION_TIMESTAMPDAYS_SINCE_CREATIONUSER_CREATORSPECIAL_AUTHORITIESGROUP_PROFILE_NAMENO_PASSWORD_INDICATORPASSWORD_EXPIRATION_INTERVALUSER_EXPIRATION_DATETEXT_DESCRIPTION
CONTRACTOR1*ENABLED*USER2025-09-30 10:14:227QSECOFR*NONECONTGRPNO902025-12-31External Contractor - Project Alpha
SVCREPORT*ENABLED*USER2025-09-25 08:30:0512DBADMIN*NONEBATCHGRPYES90—Reporting Service Account
TEMPAUDIT*ENABLED*USER2025-09-22 14:55:1815QSECOFR*AUDIT*NONENO302025-10-31Temp auditor - external review
JPEREZ*ENABLED*PGMR2025-09-18 09:02:4419QSECOFR*NONEDEVTEAMNO90—Jorge Perez - New Developer
POWERUSER1*ENABLED*SYSOPR2025-09-10 16:47:3327DBADMIN*ALLOBJ *JOBCTL*NONENO*NOMAX—Elevated ops account
Note: POWERUSER1 warrants immediate attention — created by a non-security-officer (DBADMIN), granted *ALLOBJ and *JOBCTL, with a non-expiring password and no expiration date. SVCREPORT was also created by DBADMIN — confirm as an authorized provisioning path. CONTRACTOR1 and TEMPAUDIT have USER_EXPIRATION_DATE set — good practice for time-limited access.

Notes

  • CREATION_TIMESTAMP is the authoritative creation date for the profile object.
  • USER_CREATOR identifies which profile ran CRTUSRPRF — useful for confirming authorized provisioning.
  • To detect modifications to existing profiles, use Query 5 which cross-references the security audit journal CP entries.

5. User Profile Changes Cross-Referenced with Audit Journal

⚠ Risk Level: HIGH

SYSTOOLS.AUDIT_JOURNAL_CP is a SQL table function that surfaces Class CP (User Profile Changed) entries directly from the IBM i security audit journal (QAUDJRN). Joining it with QSYS2.USER_INFO provides a complete picture: which profiles were changed, when, by whom, and what the profile currently looks like.

Prerequisite: The system audit level must include *SECURITY. Verify with DSPSYSVAL SYSVAL(QAUDLVL).

SQL

--  category:  IBM i Services
--  description:  Security - User profile changes via SYSTOOLS.AUDIT_JOURNAL_CP
--  minvrm:  v7r5m0
 
--
-- Cross-references recent user profile change events recorded in the IBM i
-- security audit journal (entry type CP = User Profile Changed) with the
-- current state of the profile from QSYS2.USER_INFO.
--
-- SYSTOOLS.AUDIT_JOURNAL_CP is a table function; invoke it in the FROM clause
-- using TABLE(). Adjust the timestamp parameters to suit your review window.
--
-- Key columns from the table function:
--   USER_PROFILE      - The profile that was changed
--   USER_NAME         - Who made the change
--   COMMAND_TYPE      - How it was changed: CHG, CRT, DST, RPA, RST, SQL
--   STATUS            - New status if changed (NULL if not changed)
--   SPECIAL_AUTHORITIES       - Current special authorities after change
--   PREVIOUS_SPECIAL_AUTHORITIES - Special authorities before the change
--   PASSWORD_CHANGED  - YES if the password was reset
--   PASSWORD_EXPIRATION_INTERVAL - New expiry setting if changed
--   USER_CLASS_NAME   - New user class if changed
--   GROUP_PROFILE_NAME - New group profile if changed
--
SELECT
    cp.ENTRY_TIMESTAMP,
    cp.USER_NAME                       AS CHANGED_BY,
    cp.USER_PROFILE                    AS CHANGED_PROFILE,
    cp.COMMAND_TYPE,
    cp.ENTRY_TYPE_DETAIL,
    -- What changed in this entry (NULLs mean that attribute was not touched)
    cp.STATUS                          AS NEW_STATUS,
    cp.USER_CLASS_NAME                 AS NEW_USER_CLASS,
    cp.SPECIAL_AUTHORITIES             AS NEW_SPCAUT,
    cp.PREVIOUS_SPECIAL_AUTHORITIES    AS PREV_SPCAUT,
    cp.PASSWORD_CHANGED,
    cp.PASSWORD_EXPIRATION_INTERVAL    AS NEW_PWD_EXPIRY,
    cp.NO_PASSWORD_INDICATOR           AS NEW_NO_PWD,
    cp.GROUP_PROFILE_NAME              AS NEW_GROUP_PROFILE,
    -- Current state of the profile from USER_INFO
    u.STATUS                           AS CURRENT_STATUS,
    u.SPECIAL_AUTHORITIES              AS CURRENT_SPCAUT,
    u.USER_CLASS_NAME                  AS CURRENT_CLASS,
    CASE u.PASSWORD_EXPIRATION_INTERVAL
        WHEN -1 THEN '*NOMAX'
        WHEN  0 THEN '*SYSVAL'
        ELSE CHAR(u.PASSWORD_EXPIRATION_INTERVAL)
    END                                AS CURRENT_PWD_EXPIRY,
    u.PREVIOUS_SIGNON,
    u.TEXT_DESCRIPTION
FROM TABLE(
    SYSTOOLS.AUDIT_JOURNAL_CP(
        STARTING_TIMESTAMP => CURRENT TIMESTAMP - 30 DAYS,
        ENDING_TIMESTAMP   => CURRENT TIMESTAMP
    )
) AS cp
LEFT JOIN QSYS2.USER_INFO u
       ON u.AUTHORIZATION_NAME = cp.USER_PROFILE
ORDER BY cp.ENTRY_TIMESTAMP DESC
WITH UR;

Sample Output

ENTRY_TIMESTAMPCHANGED_BYCHANGED_PROFILECOMMAND_TYPENEW_STATUSNEW_USER_CLASSNEW_SPCAUTPREV_SPCAUTPASSWORD_CHANGEDNEW_GROUP_PROFILECURRENT_STATUSCURRENT_SPCAUTCURRENT_CLASSCURRENT_PWD_EXPIRY
2025-10-06 22:31:05QSECOFRPOWERUSER1CHG——*ALLOBJ *JOBCTL*JOBCTL——*ENABLED*ALLOBJ *JOBCTL*SYSOPR*NOMAX
2025-10-05 14:12:44DBADMINSVCREPORTCHG————YES—*ENABLED*NONE*USER*SYSVAL
2025-10-03 08:47:20QSECOFRJSMITHCHG—————POWERGRP*ENABLED*NONE*PGMR90
2025-10-01 17:03:11DBADMINRLOPEZCHG—*SYSOPR————*ENABLED*NONE*SYSOPR90
2025-09-29 23:58:02QSYSCONTRACTOR1CHG*DISABLED—————*DISABLED*NONE*USER90
Note: null values (shown as —) mean that attribute was not modified in that journal entry. Row 1: POWERUSER1 gained *ALLOBJ (PREV: *JOBCTL → NEW: *ALLOBJ *JOBCTL). Row 4: RLOPEZ promoted to *SYSOPR by DBADMIN — a change that should come from a security officer. Row 5: CONTRACTOR1 disabled automatically by QSYS at profile expiration.

Interpretation

  • CHANGED_BY reveals who made the change. Non-security-officers modifying profiles is a red flag.
  • COMMAND_TYPE: CHG = CHGUSRPRF; CRT = CRTUSRPRF; DST = DST password reset; RPA = Reset Profile Attributes API; RST = RSTUSRPRF; SQL = Db2 routing procedure.
  • Compare NEW_SPCAUT vs PREV_SPCAUT to identify special authority additions or removals.
  • A pattern of changes outside of normal business hours warrants investigation.

6. Profiles with Default or Known Passwords

⚠ Risk Level: CRITICAL

IBM i ships with a set of IBM-supplied user profiles that historically have well-known default passwords. Any enabled IBM-supplied profile with a password unchanged since creation is a high-value attack target.

Profiles where NO_PASSWORD_INDICATOR = 'YES' have *NONE set as their password. They cannot be used to sign on interactively and are excluded from results.

SQL

--  category:  IBM i Services
--  description:  Security - IBM-supplied profiles with potentially default passwords
--  minvrm:  v7r3m0
 
--
-- Identifies all IBM-supplied profiles (any profile beginning with 'Q')
-- that are enabled and could be used for sign-on purposes.
-- Profiles with NO_PASSWORD_INDICATOR = 'YES' have *NONE as their password
-- and cannot be used to sign on interactively, so they are excluded —
-- they present no credential-guessing risk.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.NO_PASSWORD_INDICATOR,
    u.PASSWORD_CHANGE_DATE,
    CASE WHEN u.PASSWORD_CHANGE_DATE IS NULL THEN 99999
         ELSE DAYS(CURRENT_DATE) - DAYS(DATE(u.PASSWORD_CHANGE_DATE))
    END AS DAYS_SINCE_PASSWORD_CHANGE,
    u.SPECIAL_AUTHORITIES,
    u.USER_CLASS_NAME,
    u.PREVIOUS_SIGNON,
    u.TEXT_DESCRIPTION
FROM QSYS2.USER_INFO u
WHERE u.AUTHORIZATION_NAME LIKE 'Q%'    -- All IBM-supplied profiles
  AND u.STATUS               = '*ENABLED'
  AND u.NO_PASSWORD_INDICATOR = 'NO'    -- Exclude *NONE password profiles; cannot sign on
ORDER BY DAYS_SINCE_PASSWORD_CHANGE DESC,
         u.AUTHORIZATION_NAME
WITH UR;

Recommended Actions

  • Immediately change the password for any enabled IBM-supplied profile, especially QSECOFR.
  • Disable IBM-supplied profiles not required for system function: CHGUSRPRF USRPRF(<name>) STATUS(*DISABLED).
  • For QSECOFR, use CHGUSRPRF USRPRF(QSECOFR) PASSWORD(<complex_password>) and document in a sealed-envelope procedure.

7. Inactive User Profiles

⚠ Risk Level: HIGH

Profiles that have not been used for an extended period (e.g., 90 days) represent stale accounts that may belong to former employees, contractors, or decommissioned services.

SQL

--  category:  IBM i Services
--  description:  Security - Enabled user profiles with no recent sign-on
--  minvrm:  v7r3m0
 
--
-- Identifies enabled profiles with no sign-on activity in the last 90 days.
-- Profiles with NULL PREVIOUS_SIGNON have never been used since creation.
-- Adjust the inactivity threshold to match your organizational policy.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.USER_CLASS_NAME,
    CASE WHEN u.PREVIOUS_SIGNON IS NULL
         THEN 'Never signed on'
         ELSE CHAR(u.PREVIOUS_SIGNON)
    END AS PREVIOUS_SIGNON,
    CASE
        WHEN u.PREVIOUS_SIGNON IS NULL
            THEN 'Never signed on'
        ELSE CHAR(DAYS(CURRENT_DATE) - DAYS(DATE(u.PREVIOUS_SIGNON)))
    END AS DAYS_SINCE_LAST_SIGNON,
    u.SPECIAL_AUTHORITIES,
    u.GROUP_PROFILE_NAME,
    u.NO_PASSWORD_INDICATOR,
    u.PASSWORD_EXPIRATION_INTERVAL,
    u.TEXT_DESCRIPTION
FROM QSYS2.USER_INFO u
WHERE u.STATUS = '*ENABLED'
  AND (
      u.PREVIOUS_SIGNON IS NULL
      OR DATE(u.PREVIOUS_SIGNON) < CURRENT_DATE - 90 DAYS
  )
  AND u.AUTHORIZATION_NAME NOT LIKE 'Q%'   -- Exclude IBM-supplied profiles
ORDER BY DAYS_SINCE_LAST_SIGNON DESC,
         u.AUTHORIZATION_NAME
WITH UR;

Notes

  • IBM-supplied profiles (beginning with Q) are excluded — they are not expected to sign on interactively.
  • PREVIOUS_SIGNON IS NULL indicates the profile was created but never used for an interactive sign-on — always investigate.
  • PREVIOUS_SIGNON only tracks interactive sign-ons. A profile with no sign-on history may still be actively used internally — for example, as a job owner, batch job user, or adopted authority profile. Always cross-check against the LAST_USED_TIMESTAMP column in QSYS2.USER_INFO (or the Last used field on DSPUSRPRF). A profile with PREVIOUS_SIGNON IS NULL but a recent LAST_USED_TIMESTAMP is in active internal use and should not be disabled without further investigation.
Important — *DISABLED Profiles: Setting a profile to *DISABLED prevents interactive sign-on only. A *DISABLED profile can still be used for batch processing — for example, as the user profile specified on a submitted job (SBMJOB USER(<name>)), as a job owner, or under adopted authority. Verify the profile is not referenced in any scheduled jobs, job descriptions, or application configurations before disabling it.

Recommended Actions

  • Disable profiles inactive for more than 90 days unless a documented exception exists:
    CHGUSRPRF USRPRF(<name>) STATUS(*DISABLED)
  • For time-limited accounts, set a profile expiration date at provisioning time:
    CHGUSRPRF USRPRF(<name>) USREXPDATE(<mm/dd/yyyy>) USREXPITV(*USREXPDATE)
  • Delete profiles inactive for more than 180 days that have no object ownership.
  • Set USREXPDATE at the time of provisioning for any account with a known end date.

8. Profiles with Unlimited Sign-On Attempts

⚠ Risk Level: HIGH

The MAXIMUM_SIGN_ON_ATTEMPTS column controls how many consecutive failed sign-ons are allowed before a profile is disabled. The value *SYSVAL means the profile defers to the system value QMAXSIGN, while an explicit numeric value (1–25) overrides it. Profiles set to a very high limit are vulnerable to brute-force attacks.

SQL

--  category:  IBM i Services
--  description:  Security - Profiles with no lockout on failed sign-on attempts
--  minvrm:  v7r5m0
 
--
-- Identifies enabled interactive user profiles where MAXIMUM_SIGN_ON_ATTEMPTS
-- is set to *SYSVAL (meaning risk is controlled only by QMAXSIGN), OR where
-- the value is numeric but set high (> 5).
-- Profiles with NO_PASSWORD_INDICATOR = 'YES' are excluded because they
-- authenticate without a password and are not subject to sign-on lockout.
-- Also surfaces the current bad-attempt counter to flag accounts under attack.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.USER_CLASS_NAME,
    u.MAXIMUM_SIGN_ON_ATTEMPTS,
    u.SIGN_ON_ATTEMPTS_NOT_VALID,
    u.SPECIAL_AUTHORITIES,
    u.NO_PASSWORD_INDICATOR,
    u.PREVIOUS_SIGNON,
    u.TEXT_DESCRIPTION
FROM QSYS2.USER_INFO u
WHERE u.STATUS                   = '*ENABLED'
  AND u.NO_PASSWORD_INDICATOR    = 'NO'
  AND (
        u.MAXIMUM_SIGN_ON_ATTEMPTS = '*SYSVAL'  -- relies solely on QMAXSIGN
     OR CAST(u.MAXIMUM_SIGN_ON_ATTEMPTS AS INTEGER) > 5
  )
ORDER BY u.SIGN_ON_ATTEMPTS_NOT_VALID DESC,
         COALESCE(u.SPECIAL_AUTHORITIES, '') DESC,
         u.AUTHORIZATION_NAME
WITH UR;

Sample Output

AUTHORIZATION_NAMESTATUSUSER_CLASS_NAMEMAXIMUM_SIGN_ON_ATTEMPTSSIGN_ON_ATTEMPTS_NOT_VALIDSPECIAL_AUTHORITIESNO_PASSWORD_INDICATORPREVIOUS_SIGNONTEXT_DESCRIPTION
DBADMIN*ENABLED*SECOFR*SYSVAL3*ALLOBJ *SECADMNO2025-10-06 14:22:10Database Administrator
JSMITH*ENABLED*PGMR*SYSVAL2*NONENO2025-10-07 08:15:44Jane Smith - Development
APPADMIN*ENABLED*SYSOPR100*JOBCTL *SPLCTLNO2025-10-05 11:30:09Application Admin
RLOPEZ*ENABLED*PGMR*SYSVAL0*NONENO2025-09-30 09:17:44Ricardo Lopez - Development
TEMPAUDIT*ENABLED*USER250*AUDITNO2025-10-01 09:00:00Temp auditor - external review
Note: Ordered by SIGN_ON_ATTEMPTS_NOT_VALID descending. DBADMIN with 3 failed attempts and *ALLOBJ *SECADM is highest priority — privileged account potentially under brute-force attack. APPADMIN and TEMPAUDIT have explicit numeric overrides (10 and 25) that bypass QMAXSIGN and must be reset.

Recommended Actions

  • Ensure QMAXSIGN is set to 3–5 attempts system-wide: CHGSYSVAL SYSVAL(QMAXSIGN) VALUE(3).
  • Profiles set to *SYSVAL will automatically respect QMAXSIGN — no profile-level change needed once the system value is correct.
  • Reset any profile with an explicit override higher than 5: CHGUSRPRF USRPRF(<name>) MAXSIGN(*SYSVAL).
  • Monitor SIGN_ON_ATTEMPTS_NOT_VALID > 0 for profiles that may be under active password-guessing attack.

9. Service Accounts and System Profiles Review

ⓘ Risk Level: MEDIUM

Service accounts — profiles used by applications, batch jobs, or middleware — often require elevated authorities and non-expiring credentials. However, they can accumulate excessive permissions over time. This query surfaces profiles that exhibit service-account characteristics and flags those with authorities beyond what is typically needed.

SQL

--  category:  IBM i Services
--  description:  Security - Service account profiles with elevated authority
--  minvrm:  v7r5m0
 
--
-- Identifies profiles that have characteristics of service accounts
-- (no-password indicator, or non-expiring password, combined with
-- enabled status) and cross-checks for elevated special authorities.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.USER_CLASS_NAME,
    u.NO_PASSWORD_INDICATOR,
    u.PASSWORD_EXPIRATION_INTERVAL,
    u.SPECIAL_AUTHORITIES,
    u.GROUP_PROFILE_NAME,
    u.MAXIMUM_SIGN_ON_ATTEMPTS,
    u.PREVIOUS_SIGNON,
    u.HOME_DIRECTORY,
    u.TEXT_DESCRIPTION,
    CASE
        WHEN u.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
              OR u.SPECIAL_AUTHORITIES LIKE '%*SECADM%'
            THEN 'CRITICAL - Elevated Special Auth'
        WHEN u.SPECIAL_AUTHORITIES LIKE '%*JOBCTL%'
              OR u.SPECIAL_AUTHORITIES LIKE '%*SAVSYS%'
            THEN 'HIGH - Significant Special Auth'
        WHEN u.SPECIAL_AUTHORITIES IS NOT NULL
              AND u.SPECIAL_AUTHORITIES <> ''
            THEN 'MEDIUM - Has Special Auth'
        ELSE 'LOW - No Special Auth'
    END AS RISK_ASSESSMENT
FROM QSYS2.USER_INFO u
WHERE u.STATUS = '*ENABLED'
  AND (
        u.NO_PASSWORD_INDICATOR         = 'YES'
     OR u.PASSWORD_EXPIRATION_INTERVAL  = -1       -- -1 = *NOMAX
  )
  AND u.AUTHORIZATION_NAME NOT LIKE 'Q%'
ORDER BY
    CASE
        WHEN u.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
              OR u.SPECIAL_AUTHORITIES LIKE '%*SECADM%'   THEN 1
        WHEN u.SPECIAL_AUTHORITIES LIKE '%*JOBCTL%'
              OR u.SPECIAL_AUTHORITIES LIKE '%*SAVSYS%'   THEN 2
        ELSE 3
    END,
    u.AUTHORIZATION_NAME
WITH UR;

10. Group Profile Membership Summary

ⓘ Risk Level: MEDIUM

Group profiles allow IBM i to manage authority collectively. A user who is a member of a powerful group profile inherits its authorities. This query provides an inventory of all group profile memberships, useful for identifying users with indirect elevated access.

SQL

--  category:  IBM i Services
--  description:  Security - Group profile membership with inherited special authorities
--  minvrm:  v7r3m0
 
--
-- Lists all group profile members alongside the authorities held by
-- the group. Useful for identifying users who have indirect access to
-- special authorities through group membership.
--
SELECT
    gpe.GROUP_PROFILE_NAME,
    g.SPECIAL_AUTHORITIES    AS GROUP_SPECIAL_AUTHORITIES,
    g.USER_CLASS_NAME        AS GROUP_CLASS,
    g.STATUS                 AS GROUP_STATUS,
    gpe.USER_PROFILE_NAME    AS MEMBER_PROFILE,
    u.STATUS                 AS MEMBER_STATUS,
    u.USER_CLASS_NAME        AS MEMBER_CLASS,
    u.SPECIAL_AUTHORITIES    AS MEMBER_OWN_SPCAUT,
    u.PREVIOUS_SIGNON        AS MEMBER_LAST_SIGNON,
    u.TEXT_DESCRIPTION       AS MEMBER_DESCRIPTION
FROM QSYS2.GROUP_PROFILE_ENTRIES gpe
JOIN QSYS2.USER_INFO g
  ON g.AUTHORIZATION_NAME = gpe.GROUP_PROFILE_NAME
JOIN QSYS2.USER_INFO u
  ON u.AUTHORIZATION_NAME = gpe.USER_PROFILE_NAME
WHERE g.STATUS = '*ENABLED'
ORDER BY gpe.GROUP_PROFILE_NAME,
         gpe.USER_PROFILE_NAME
WITH UR;

Sample Output

GROUP_PROFILE_NAMEGROUP_SPECIAL_AUTHORITIESGROUP_CLASSGROUP_STATUSMEMBER_PROFILEMEMBER_STATUSMEMBER_CLASSMEMBER_OWN_SPCAUTMEMBER_LAST_SIGNONMEMBER_DESCRIPTION
POWERGRP*ALLOBJ *JOBCTL*SECOFR*ENABLEDDBADMIN*ENABLED*SECOFR*ALLOBJ *SECADM2025-10-06 14:22:10Database Administrator
POWERGRP*ALLOBJ *JOBCTL*SECOFR*ENABLEDJSMITH*ENABLED*PGMR*NONE2025-10-07 08:15:44Jane Smith - Development
POWERGRP*ALLOBJ *JOBCTL*SECOFR*ENABLEDRLOPEZ*ENABLED*PGMR*NONE2025-09-30 09:17:44Ricardo Lopez - Development
BATCHGRP*JOBCTL *SAVSYS*SYSOPR*ENABLEDSVCBATCH*ENABLED*USER*NONE2025-10-06 02:00:00Nightly batch service
BATCHGRP*JOBCTL *SAVSYS*SYSOPR*ENABLEDSVCREPORT*ENABLED*USER*NONE2025-10-04 02:00:00Reporting Service Account
Note: JSMITH and RLOPEZ have no direct special authorities (MEMBER_OWN_SPCAUT = *NONE) but inherit *ALLOBJ *JOBCTL through POWERGRP — a common finding easy to miss when reviewing profiles in isolation. DBADMIN is doubly privileged: direct *ALLOBJ *SECADM plus group inheritance. BATCHGRP grants *JOBCTL *SAVSYS to two service accounts — confirm as the minimum required authority.

11. Consolidated Risk Summary

ⓘ Risk Level: INFORMATIONAL

This summary query provides a single-view risk assessment of all non-IBM-supplied enabled user profiles. It combines multiple risk indicators into a composite score to prioritize follow-up actions. Use this as a daily or weekly administrative dashboard query.

SQL

--  category:  IBM i Services
--  description:  Security - Consolidated user profile risk summary
--  minvrm:  v7r3m0
 
--
-- Consolidated user profile risk summary.
-- Flags multiple risk conditions per profile and assigns an overall
-- risk tier to prioritize security review.
--
SELECT
    u.AUTHORIZATION_NAME,
    u.STATUS,
    u.USER_CLASS_NAME,
 
    -- Risk flags
    CASE WHEN u.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
              OR u.SPECIAL_AUTHORITIES LIKE '%*SECADM%'
         THEN 'YES' ELSE 'NO' END AS FLAG_HIGH_SPCAUT,
 
    CASE WHEN u.PASSWORD_EXPIRATION_INTERVAL = -1   -- -1 = *NOMAX
               AND u.NO_PASSWORD_INDICATOR = 'NO'
         THEN 'YES' ELSE 'NO' END AS FLAG_NO_PWD_EXPIRY,
 
    CASE WHEN u.MAXIMUM_SIGN_ON_ATTEMPTS <> '*SYSVAL'
               AND CAST(u.MAXIMUM_SIGN_ON_ATTEMPTS AS INTEGER) > 5
               AND u.NO_PASSWORD_INDICATOR = 'NO'
         THEN 'YES' ELSE 'NO' END AS FLAG_HIGH_MAXSIGN,
 
    CASE WHEN u.PREVIOUS_SIGNON IS NULL
               OR DATE(u.PREVIOUS_SIGNON) < CURRENT_DATE - 90 DAYS
         THEN 'YES' ELSE 'NO' END AS FLAG_INACTIVE,
 
    CASE WHEN u.CREATION_TIMESTAMP >= CURRENT TIMESTAMP - 30 DAYS
         THEN 'YES' ELSE 'NO' END AS FLAG_RECENTLY_CREATED,
 
    -- Current values
    u.SPECIAL_AUTHORITIES,
    u.PASSWORD_EXPIRATION_INTERVAL,
    u.MAXIMUM_SIGN_ON_ATTEMPTS,
    u.PREVIOUS_SIGNON,
    u.CREATION_TIMESTAMP,
    u.NO_PASSWORD_INDICATOR,
    u.GROUP_PROFILE_NAME,
    u.TEXT_DESCRIPTION,
 
    -- Composite risk tier
    CASE
        WHEN (u.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
              OR u.SPECIAL_AUTHORITIES LIKE '%*SECADM%')
         AND  u.PASSWORD_EXPIRATION_INTERVAL = -1
         AND  u.NO_PASSWORD_INDICATOR = 'NO'
            THEN '1 - CRITICAL'
        WHEN u.SPECIAL_AUTHORITIES LIKE '%*ALLOBJ%'
              OR u.SPECIAL_AUTHORITIES LIKE '%*SECADM%'
            THEN '2 - HIGH (Elevated Authority)'
        WHEN u.PASSWORD_EXPIRATION_INTERVAL = -1
              AND u.NO_PASSWORD_INDICATOR = 'NO'
            THEN '3 - HIGH (No Password Expiry)'
        WHEN u.MAXIMUM_SIGN_ON_ATTEMPTS <> '*SYSVAL'
              AND CAST(u.MAXIMUM_SIGN_ON_ATTEMPTS AS INTEGER) > 5
              AND u.NO_PASSWORD_INDICATOR = 'NO'
            THEN '4 - HIGH (Weak Lockout Policy)'
        WHEN u.PREVIOUS_SIGNON IS NULL
              OR DATE(u.PREVIOUS_SIGNON) < CURRENT_DATE - 90 DAYS
            THEN '5 - MEDIUM (Inactive)'
        WHEN u.CREATION_TIMESTAMP >= CURRENT TIMESTAMP - 30 DAYS
            THEN '6 - REVIEW (Recently Created)'
        ELSE '7 - LOW'
    END AS RISK_TIER
 
FROM QSYS2.USER_INFO u
WHERE u.STATUS             = '*ENABLED'
  AND u.AUTHORIZATION_NAME NOT LIKE 'Q%'
ORDER BY RISK_TIER,
         u.AUTHORIZATION_NAME
WITH UR;

Sample Output

AUTHORIZATION_NAMESTATUSUSER_CLASS_NAMEFLAG_HIGH_SPCAUTFLAG_NO_PWD_EXPIRYFLAG_HIGH_MAXSIGNFLAG_INACTIVEFLAG_RECENTLY_CREATEDSPECIAL_AUTHORITIESPWD_EXPIRY_INTERVALMAX_SIGNON_ATTEMPTSPREVIOUS_SIGNONNO_PWDGROUP_PROFILE_NAMETEXT_DESCRIPTIONRISK_TIER
DBADMIN*ENABLED*SECOFRYESYESNONONO*ALLOBJ *SECADM-1*SYSVAL2025-10-06 14:22:10NO*NONEDatabase Administrator1 - CRITICAL
APPADMIN*ENABLED*SYSOPRNONOYESNONO*JOBCTL *SPLCTL90102025-10-05 11:30:09NOOPSGRPApplication Admin4 - HIGH (Weak Lockout)
OLDUSER*ENABLED*USERNONONOYESNO*NONE90*SYSVAL2025-05-12 08:00:00NODEVTEAMFormer contractor5 - MEDIUM (Inactive)
CONTRACTOR1*ENABLED*USERNONONONOYES*NONE90*SYSVAL2025-10-02 09:15:00NOCONTGRPExternal Contractor - Project Alpha6 - REVIEW (Recently Created)
JSMITH*ENABLED*PGMRNONONONONO*NONE90*SYSVAL2025-10-07 08:15:44NODEVTEAMJane Smith - Development7 - LOW
Note: Sample data is illustrative only, relative to run date 2025-10-07. Each row represents a different risk tier. DBADMIN is Tier 1: combines *ALLOBJ *SECADM with a non-expiring password (-1). APPADMIN is Tier 4: MAXIMUM_SIGN_ON_ATTEMPTS = 10 overrides QMAXSIGN. OLDUSER last signed on > 90 days ago. CONTRACTOR1 was created 7 days prior. JSMITH has no flags.

Interpreting the Risk Tiers

TierMeaningRecommended Action
1 - CRITICALHas *ALLOBJ/*SECADM and PASSWORD_EXPIRATION_INTERVAL = -1Immediate review and remediation
2 - HIGH (Elevated Authority)Holds *ALLOBJ or *SECADMConfirm business justification; enforce password expiry
3 - HIGH (No Password Expiry)Interactive account, PASSWORD_EXPIRATION_INTERVAL = -1Set PWDEXPITV to policy value, e.g., CHGUSRPRF ... PWDEXPITV(90)
4 - HIGH (Weak Lockout Policy)MAXIMUM_SIGN_ON_ATTEMPTS override exceeds 5Reset to *SYSVAL and verify QMAXSIGN ≤ 5
5 - MEDIUM (Inactive)No sign-on in 90+ daysDisable or delete with manager approval
6 - REVIEW (Recently Created)Profile created in last 30 daysVerify provisioning was authorized
7 - LOWNo flags raisedNo immediate action required
ServiceTypeDescription
QSYS2.USER_INFOViewCurrent user profile attributes
QSYS2.GROUP_PROFILE_ENTRIESViewGroup profile membership
SYSTOOLS.AUDIT_JOURNAL_CP()Table FunctionUser profile change audit journal entries (CP class)
QSYS2.DISPLAY_JOURNAL()Table FunctionGeneral-purpose audit journal access
QSYS2.SYSTEM_VALUE_INFOViewSystem value settings

References

Made with IBM Bob

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB68","label":"Power HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CHyAAM","label":"Security"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"and future releases;7.5.0;7.6.0"}]

Document Information

Modified date:
25 August 2026

UID

ibm17284968

Page Feedback