So under AIX 6, according to "lsuser" the user has the following settings:


So this means that 2 weeks after the last password update of the user the password will expire, but because of the "maxexpired=-1" the password will never expire, and the user [that has for ex.: only FTP access] will not be locked out?

I'm asking because I got two different descriptions for "maxexpired":

"man" source #1:

enter image description here

"man" source #2:


Defines the maximum time (in weeks) beyond the maxage value that a user can change an expired password. After this defined time, only an administrative user can change the password. The value is a decimal integer string. The default is -1, indicating restriction is set. If the maxexpired attribute is 0, the password expires when the maxage value is met. If the maxage attribute is 0, the maxexpired attribute is ignored. Range: 0 to 52 (a root user is exempt from maxexpired)

2 Answers 2


Once maxage is reached, the user cannot log on without changing his/her password.

If you set maxexpired to a positive value, the user can still change their expired password themselves (on login) during that many weeks. Past that delay, only an administrator can update the password (and thus the user cannot log in at all after that delay without help from an administrator).

When you set maxexpired to -1, this means that the user will be able to change their expired password (and thus log in) whenever they want - they won't need assistance from an administrator to be able to update their password and log back in.

  • I'm on this opinion too, but I need confirmation for this that it's 100% true. Nov 12, 2011 at 16:21
  • I don't get what you don't understand from the documentation. A password must be changed after it has expired (see the maxage docs). The maxexpired is just an (optional and possibly infinite) grace period.
    – Mat
    Nov 12, 2011 at 16:38
  • I just need 100% confirmation for that that the user doesn't get's locked out, if the "maxexpired=-1". [and maxage not 0 + maxage week already went away, according to last password update]. the user can only has access via ftp. Nov 12, 2011 at 16:47
  • If they can't change their password via FTP, they'll effectively be locked out.
    – Mat
    Nov 12, 2011 at 16:49
  • but if the maxexpired is set to -1? Nov 12, 2011 at 16:59

Since I can't comment yet - @LanceBaynes - The answer by Mat is correct. The user will be locked out, which is not a problem but a security measure to prevent users that haven't used their account for a long time (for example got fired), not to be able to access their accounts by changing passwords if they gained access somehow to a workstation inside the company. The password can be changed anytime by the administrator once the maxexpired time is over.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .