I am using the NEWLIST TYPE=ID to select all users with TSO capability.

The 1st EXCLUDE statement for userid works fine.

But have trouble to also exclude on selective group IDs (dfltgrp)

n type=id                                                              
select tso=yes complex=ABC
exclude id=USER*                                                            
exclude id=GROUP*                                                              
display id complex tso :dfltgrp(8) :ljdate(10) :last_connect_date(10),                                  
 :revoke('Revoked',1,8) :revoke_inactive('Inactive',1,8)  

Francis, 

I do not fully understand what your requirement for this report is. If you want to report all TSO user IDs, why don't just use newlist type RACF for that purpose.

n type=racf t="All users with TSO capability"                         
 select class=user segment=tso complex=nmpipl87                       
display key(8) complex :dfltgrp(8) :ljdate(10) :last_connect_date(10),
 :revoke('Revoked',1,8) :revoke_inactive('Inactive',1,8)              

Wouldn't that satisfy you requirement? Why did you decide to use newlist type ID for this report.

Tom,

Initially I did use type RACF with segment=TSO, but as I also want to exclude users with specific DFLTGRPS (which is part of the BASE segment) .

As this will not work because DFLTGRPS is pasrt os sement BASE, I thought type ID moight be a alternative

n type=racf t="All users with TSO capability"                         
 select class=user segment=tso complex=nmpipl87         
 exclude dfltgrp=GROUP99           
display key(8) complex :dfltgrp(8) :ljdate(10) :last_connect_date(10),
 :revoke('Revoked',1,8) :revoke_inactive('Inactive',1,8)      

n type=racf t="All users with TSO capability"                          select class=user segment=tso complex=nmpipl87                       display key(8) complex :dfltgrp(8) :ljdate(10) :last_connect_date(10), :revoke('Revoked',1,8) :revoke_inactive('Inactive',1,8)              

You can actually select profiles using fields from different segments in newlist type=racf, but not in a single newlist.  You have to use PROFLIST for this.

n type=racf outlim=0 name=exdfltgr
 select class=user segment=base dfltgrp<>GROUP99
 display key

n type=racf proflist=exdfltgr t="All users with TSO capability"
 select class=user segment=tso complex=nmpipl87
display key(8) complex :dfltgrp(8) :ljdate(10) :last_connect_date(10),
 :revoke('Revoked',1,8) :revoke_inactive('Inactive',1,8)

You can also get CARLa code like this generated by option RA.U, when you specify a default group name in the Default group field and write a / in front of Segment presence.  Press enter and select the TSO segment from the list.  This will find only TSO segments when the default group matches the given value.

You can also tweak your newlist type=ID query:

n type=id                                                              
select tso=yes complex=ABC
exclude id=USER*                                                            
exclude id:dfltgrp=GROUP99   /* use field lookup from id value */                                                             
display id complex tso :dfltgrp(8) :ljdate(10) :last_connect_date(10),                                  
 :revoke('Revoked',1,8) :revoke_inactive('Inactive',1,8)  

------------------------------
Rob van Hoboken
------------------------------

Many thanks Rob, 

This is what I was looking for. 

I used both variants of type=ID and type=RACF and get same results:

Name     Summary Records Title                                      
TYPEID     14416   14416 All users with TSO capability - type=ID    
TYPERACF   14416   14416 All users with TSO capability - type=RACF  

n type=racf outlim=0 name=exdfltgr select class=user segment=base dfltgrp<>GROUP99 display keyn type=racf proflist=exdfltgr t="All users with TSO capability" select class=user segment=tso complex=nmpipl87display key(8) complex :dfltgrp(8) :ljdate(10) :last_connect_date(10), :revoke('Revoked',1,8) :revoke_inactive('Inactive',1,8)

n type=id                                                              select tso=yes complex=ABCexclude id=USER*                                                            exclude id:dfltgrp=GROUP99   /* use field lookup from id value */                                                             display id complex tso :dfltgrp(8) :ljdate(10) :last_connect_date(10),                                   :revoke('Revoked',1,8) :revoke_inactive('Inactive',1,8)