This specifies the Vserver name associated with the profile configuration.

This specifies the role whose account restrictions are to be modified.

This specifies the required minimum length of the user name. Supported values are 3 to 16 characters. The default setting is 3 characters.

This specifies whether a mix of alphabetic and numeric characters are required in the user name. If this parameter is enabled, a user name must contain at least one letter and one number. The default setting is disabled .

This specifies the required minimum length of a password. Supported values are 3 to 64 characters. The default setting is 8 characters.

This specifies whether a mix of alphabetic and numeric characters is required in the password. If this parameter is enabled, a password must contain at least one letter and one number. The default setting is enabled .

This specifies the minimum number of special characters required in a password. Supported values are from 0 to 64 special characters. The default setting is 0 , which requires no special characters.

This specifies password expiration in days. A value of 0 means all passwords associated with the accounts in the role expire now. The default setting is unlimited , which means the passwords never expire.

This specifies whether users must change their passwords when logging in for the first time. Initial password changes can be done only through SSH or serial-console connections. The default setting is disabled .

This specifies the allowed maximum number of consecutive invalid login attempts. When the failed login attempts reach the specified maximum, the account is automatically locked. The default is 5 , which means 5 failed login attempts will cause an account to be locked.

(DEPRECATED)-This specifies the number of days for which an account is locked if the failed login attempts reach the allowed maximum. The default is 0 , which means the accounts will be locked for 1 hour. For roles which were created in a release before ONTAP 9.15.0 with the default value of 0 , this value will be automatically changed to 1 during upgrade to ONTAP 9.15.0. In other words, the value of this field for roles created before ONTAP 9.15.0 is defaulted to 24 hrs. For the roles which are created in ONTAP 9.15.0 or later, the value of this field defaults to 1 hour. This parameter is deprecated in ONTAP 9.15.0 and later. It may be removed from a future release of ONTAP.

This specifies the number of previous passwords that are disallowed for reuse. The default setting is six, meaning that the user cannot reuse any of their last six passwords. The minimum allowed value is 6 .

This specifies the number of days that must pass between password changes. The default setting is 0 .

This specifies the amount of delay observed by the system in seconds upon invalid login attempts. The default setting is 4 seconds.

This specifies the minimum number of lowercase characters required in a password. Supported values are from 0 to 64 lowercase characters. The default setting is 0 , which requires no lowercase characters.

This specifies the minimum number of uppercase characters required in a password. Supported values are from 0 to 64 uppercase characters. The default setting is 0 , which requires no uppercase characters.

This specifies the minimum number of digits required in a password. Supported values are from 0 to 64 digits charaters. The default setting is 0 , which requires no digits.

This specifies the warning period for password expiry in days. A value of 0 means warn user about password expiry upon every successful login. The default setting is unlimited , which means never warn about password expiry.

This specifies account expiration in days. The default setting is unlimited , which means the accounts never expire. The account expiry time must be greater than account inactive limit.

This specifies inactive account expiry limit in days. The default setting is unlimited , which means the inactive accounts never expire. The account inactive limit must be less than account expiry time.

This specifies the duration in ISO 8601 format for which an account is locked if the failed login attempts reach the allowed maximum. The default is 1 hour. Specifying this field will set the field lockout-duration as 0 and the field account-lockout-duration will be used for further operations.