IBM i User Profiles: CRTUSRPRF, CHGUSRPRF, and DLTUSRPRF in Practice

This page is a command-level reference for the three profile-lifecycle commands: CRTUSRPRF, CHGUSRPRF, and DLTUSRPRF. It covers parameters, defaults, and the mechanics of each command only. For what the special authorities, object authority, and adopted authority actually mean and how to design them, see IBM i Security in 2026: User Profiles, Object Authority, Adopted Authority, and Practical Security Patterns; this page assumes those concepts and focuses on the command syntax.

CRTUSRPRF

CRTUSRPRF USRPRF(name) PASSWORD(*NONE | *USRPRF | 'password')
          STATUS(*ENABLED | *DISABLED) USRCLS(*USER | *SYSOPR | *PGMR | *SECADM | *SECOFR)
          SPCAUT(*USRCLS | *NONE | special-authority-values)
          INLPGM(program | *NONE) INLMNU(menu | MAIN | *SIGNOFF)
          CURLIB(library | *CRTDFT) LMTCPB(*NO | *PARTIAL | *YES)
          GRPPRF(name | *NONE) SUPGRPPRF(names | *NONE)
          JOBD(job-description | QDFTJOBD) TEXT('description')

Verification level: IBM DOC CHECKED, against the IBM i 7.5 CRTUSRPRF command reference.

A minimal create:

CRTUSRPRF USRPRF(JSMITH) PASSWORD('your-password-here') USRCLS(*USER) +
          TEXT('J Smith - AP clerk')

Verification level: IBM DOC CHECKED. Not run.

Required authority to run CRTUSRPRF:

• *SECADM special authority, which can be obtained through program adoption rather than held directly.
• *USE authority to any initial program, initial menu, job description, message queue, output queue, or attention-key program named on the command.
• *CHANGE and *OBJMGT authority to the group profile and any supplemental group profiles, if specified — adopted authority alone cannot supply *OBJMGT for this.
• Every special authority being granted to the new profile — the caller must already hold each one themselves.

The new profile automatically receives *CHANGE and *OBJMGT authority to itself; IBM’s documentation notes these should not be removed.

CHGUSRPRF

CHGUSRPRF USRPRF(user-profile) [PASSWORD(...)] [STATUS(...)] [USRCLS(...)]
          [SPCAUT(...)] [INLPGM(...)] [INLMNU(...)] [CURLIB(...)] [LMTCPB(...)]
          [GRPPRF(...)] [SUPGRPPRF(...)] [OWNER(...)] [GRPAUT(...)]
          [USREXPDATE(...)] [USREXPITV(...)] [PTYLMT(...)]

Verification level: IBM DOC CHECKED, against the IBM i 7.5 CHGUSRPRF command reference.

USRPRF is the only required parameter; every other parameter defaults to *SAME, which leaves the current value untouched. That makes a targeted change safe to issue without restating the rest of the profile:

CHGUSRPRF USRPRF(JSMITH) STATUS(*DISABLED)

Verification level: IBM DOC CHECKED. Not run.

CHGUSRPRF USRPRF(JSMITH) PWDEXP(*YES) PASSWORD(*NONE)

Verification level: IBM DOC CHECKED. Not run. Forces a password reset and signs the profile out of password-based sign-on until a new password is set.

Parameters worth calling out:

Required authority to run CHGUSRPRF:

• *SECADM special authority.
• *OBJMGT and *USE authority to the profile being changed.
• *USE authority to any current library, program, menu, job description, message queue, print device, or output queue being set.
• Every special authority being granted — the caller must already hold it.
• Granting *SECADM to someone else requires the caller to hold both *ALLOBJ and *SECADM. Granting *AUDIT requires *ALLOBJ, *SECADM, and *AUDIT.
• *OBJMGT and *CHANGE authority to any group profile named in GRPPRF or SUPGRPPRF.

DLTUSRPRF

Caution — destructive and not fully reversible. DLTUSRPRF permanently removes a user profile. With OWNOBJOPT(*DLT) it also deletes every object the profile owns, not just the profile itself, and revoked authorities and EIM associations are not automatically restored by re-creating a profile of the same name. Confirm ownership transfer (OWNOBJOPT(*CHGOWN new-owner)) is what you actually want before running this against a production profile, and test against a non-production profile first.

DLTUSRPRF USRPRF(name) OWNOBJOPT(*NODLT | *DLT | *CHGOWN new-owner)
          PGPOPT(*NOCHG | *CHGPGP new-group|*NONE)
          EIMASSOC(*DLT | *NODLT)

Verification level: IBM DOC CHECKED, against the IBM i 7.5 DLTUSRPRF command reference.

The plain command fails as soon as the profile owns anything or is a primary group for anything:

DLTUSRPRF USRPRF(JSMITH)

Verification level: IBM DOC CHECKED. If JSMITH owns objects or is a primary group, this fails with the default NODLT/NOCHG options rather than deleting partially.

The practical pattern when a user is leaving and ownership should move to a caretaker profile:

DLTUSRPRF USRPRF(JSMITH) OWNOBJOPT(*CHGOWN QPGMR) PGPOPT(*CHGPGP *NONE)

Verification level: IBM DOC CHECKED. Not run. Transfers owned objects to QPGMR and clears JSMITH as primary group on anything that had it set.

Rules that change the outcome:

• A profile cannot be deleted while a user is actively running under it.
• Owned objects of type *USRPRF, *RCT, and *AUTHLR always pass to QDFTOWN regardless of OWNOBJOPT; owned *PRDDFN objects pass to QSYS.
• A profile cannot simultaneously become both owner and primary group of the same object via a transfer — *CHGOWN/*CHGPGP fail if that would be the result.
• Granted authorities the deleted profile held are revoked automatically; there is no need to RVKOBJAUT first.
• With OWNOBJOPT(*DLT), deletion follows the same restrictions as DLTLIB — for example, an owned object currently in use cannot be deleted, and the whole DLTUSRPRF fails if it can’t complete.

Required authority to run DLTUSRPRF:

• *SECADM special authority (obtainable via adoption), plus *OBJEXIST and *USE on the profile being deleted.
• *OBJEXIST on every object the profile owns that gets deleted, and for IFS objects without *ALLOBJ, *OBJEXIST plus *WX on the containing directory.
• To delete a message queue the profile owns: *OBJEXIST, *USE, and *DLT on that queue.

Common Mistakes

• Assuming CHGUSRPRF without OWNOBJOPT/PGPOPT applies to a delete. Those two parameters belong to DLTUSRPRF only; CHGUSRPRF has no equivalent — it changes attributes of a profile that continues to exist.
• Running DLTUSRPRF on a profile that still owns objects, with the default OWNOBJOPT(*NODLT). It fails outright rather than deleting the profile and orphaning the objects.
• Granting a special authority with CHGUSRPRF SPCAUT(...) that the caller doesn’t hold themselves. The command fails — a profile can’t hand out authority it doesn’t have.
• Expecting PASSWORD to default predictably on CRTUSRPRF. IBM’s parameter table and its own worked example disagree on whether an omitted PASSWORD defaults to *NONE or to the profile name; set it explicitly rather than relying on the default.

Summary

• CRTUSRPRF needs *SECADM and every special authority it grants; most attribute parameters default sensibly (STATUS(*ENABLED), USRCLS(*USER), LMTCPB(*NO)).
• CHGUSRPRF defaults nearly every parameter to *SAME, so a targeted change only needs USRPRF plus the parameters actually changing.
• DLTUSRPRF refuses to delete a profile that owns objects or is a primary group unless OWNOBJOPT/PGPOPT are set to transfer or delete that state first.

Sources: IBM i 7.5 CRTUSRPRF command, IBM i 7.5 CHGUSRPRF command, and IBM i 7.5 DLTUSRPRF command. All examples are documentation-checked only; none were compiled or run.

For the authority concepts behind these commands, read IBM i Security in 2026.