Originally posted by: JoachimB

I found a strange userid named "hmc" on one of my AIX 6.1 systems.

The user is not listed in /etc/passwd, but "lsuser hmc"  displays it.

I decided to remove it completely from my system, but rmuser hmc results in: 3004-696 Error removing "hmc"

Where does user hmc hide and how to get rid of it completely?

Originally posted by: AncientAIXer

Usernames are in many different files.  I would try to run:

usrck -n hmc

if it returns something, run the same command with -y instead.  If it doesn't, I would grep for hmc in /etc/ and /etc/security/.

Originally posted by: JoachimB

Thanks for your answer.

usrck -n hmc

yields:
3001-618 hmc is a non-existent user.
 

... although lsuser hmc gives detailed information.

I already tried usrck -y hmc yesterday but without success.

There was an entry in /etc/security/user, that I deleted. No success either.

I think I leave it as it is.

Originally posted by: YannickBergeron

Can you show what is the lsuser output?
My guess is that this user might be on a remote registry (LDAP for example)

Originally posted by: JoachimB

Here it is:

lsuser -f hmc
hmc:
        id=325417
        pgrp=hmc
        groups=u/dero/rmsid,p/hezadefect/reader,hmc,u/bofferdn/ppm,p/cpmsdb/admin,p/hatteras/reader,p/bgv_sicily/writer
        home=/gsa/ausgsa/home/h/m/hmc
        shell=/usr/bin/ksh
        gecos=Hye-Young McCreary
        auditclasses=objects, itcs104
        login=true
        su=true
        rlogin=true
        daemon=true
        admin=false
        sugroups=ALL
        admgroups=
        tpath=nosak
        ttys=ALL
        expires=0
        auth1=SYSTEM
        auth2=NONE
        umask=77
        registry=GSA
        SYSTEM=compat
        logintimes=
        loginretries=5
        pwdwarntime=0
        account_locked=false
        minage=1
        maxage=0
        maxexpired=-1
        minalpha=1
        minother=1
        mindiff=1
        maxrepeats=2
        minlen=8
        histexpire=0
        histsize=8
        pwdchecks=
        dictionlist=
        fsize=-1
        cpu=-1
        data=-1
        stack=-1
        core=-1
        rss=-1
        nofiles=-1
        roles=
 

Originally posted by: YannickBergeron

well you've got your answer. The user is in GSA, which is a fileserver and authentication used internally in IBM.

GSA authentication and registry is based on LDAP. Therefore, this is a remote user, not a local one

You can check your GSA conf in /usr/gsa/etc/gsa.conf

Also, try this if you want to see if this user exist locally

lsuser -R files hmc