This command allows the user to change any field(s) in any user authorization
 record(s).  Wildcarding of usernames or UICs is allowed.

 Format:

        MODIFY user-spec /qualifier [/qualifiers]

Additional information available:

ParametersQualifiers

/IDENTIFIER/PROXY/SYSTEM_PASSWORD

 Modifies an identifier in the rights database.

 Format

        MODIFY/IDENTIFIER id-name

Additional information available:

ParameterQualifiersExamples

 id-name

 Specifies the name of an identifier to be modified

Additional information available:

/ATTRIBUTES/HOLDER/NAME/VALUE

 /ATTRIBUTES=(keyword)

 Specifies attributes to be associated with the modified
 identifier.  Valid keywords are:

 [NO]DYNAMIC    Indicates whether or not unprivileged holders of the
                identifier may add or remove the identifier from the
                process rights list.  The default is NODYNAMIC.

 [NO]NOACCESS   Indicates whether or not the identifier will be used
                in protection checks.  The default is NONOACCESS,
                meaning that the holder of the identifier will be
                granted or denied access to objects which list the
                identifier in their access control lists (ACLs).

 [NO]RESOURCE   Indicates whether or not holders of the identifier
                may charge resources to it.  The default is NORESOURCE.

 [NO]SUBSYSTEM  Indicates whether or not holders of the identifier
                are allowed to create protected subsystems containing
                the identifier.  The default is NOSUBSYSTEM.

 If you specify an attribute, a holder named with the /HOLDER qualifier
 gains the specified attribute.  If you specify the negated form, the named
 holder loses the specified attribute.  In addition, if you remove an
 attribute from the base identifier (i.e. you do not specify /HOLDER) then
 all holders of the identifier lose the specified attributes.

 /HOLDER=username

 Specifies the holder of an identifier whose attributes are to
 modified.  /HOLDER is used only in conjunction with
 /ATTRIBUTES qualifier.  If you specify /HOLDER, the /NAME and
 /VALUE qualifiers are ignored.

 /NAME=id-name

 Specifies a new id-name to be associated with the identifier.

 /VALUE=value-specifier

 Specifies a new identifier value.  Note, however, that an
 identifier value cannot be modified from a UIC to a non UIC
 format or vice versa.  Valid formats for the value-specifier
 are:

 IDENTIFIER:integer    An integer value in the range of 65,536 to
                       268,435,455. You may also specify the value
                       in hexadecimal (precede the value with %X) or
                       octal (precede the value with %O).

                       Note that %X80000000 is added to the value
                       you specify in order to differentiate general
                       identifiers from UIC identifiers.

 UIC:uic               A UIC value in the standard UIC format

 UAF> MODIFY/IDENTIFIER/VALUE=UIC:[300,21] ACCOUNTING
 identifier ACCOUNTING modified

        The command in this example changes the old UIC value of the
        identifier ACCOUNTING to a new value.

 UAF> MODIFY/IDENTIFIER/ATTRIBUTES=NORESOURCE/HOLDER=ALLISON ACCOUNTING
 identifier ACCOUNTING modified

        The command in this example associates the attribute NORESOURCE
        with the identifier ACCOUNTING in ALLISON's holder record.

 Modifies an entry in the network proxy authorization file.

 Format

        MODIFY/PROXY node::remote-user

Additional information available:

ParameterQualifiers

 node

 specifies a node name (1 through 6 alphanumberic characters).

 remote-user

 specifies the username or UIC of a user at a remote node.

Additional information available:

/DEFAULT

    /DEFAULT = local-user

    This qualifier selects which local user default proxy access for the
    remote user should be directed to.

 Sets the system password.

 Format

        MODIFY/SYSTEM_PASSWORD=system-password

 user-spec

 The record(s) to be modified may be specified in a variety of ways:

        1) wildcarded username (standard DCL wildcarding)
        2) wildcarded UIC, as
                a) [*,*]
                b) [*,n]
                c) [n,*]
        3) specific username
        4) specific UIC

Additional information available:

/ACCESS/ACCOUNT/ALGORITHM/ASTLM/BATCH/BIOLM
/BYTLM/CLI/CLITABLES/CPUTIME/DEFPRIVILEGES
/DEVICE/DIALUP/DIOLM/DIRECTORY/ENQLM/EXPIRATION
/FILLM/FLAGS/GENERATE/INTERACTIVE/JTQUOTA
/LGICMD/LOCAL/MAXACCTJOBS/MAXDETACH/MAXJOBS
/MODIFY_IDENTIFIER/NETWORK/OWNER/PASSWORD/PFLAGS
/PGFLQUOTA/P_RESTRICT/PRCLM/PRIMEDAYS
/PRIORITY/PRIVILEGES/PWDEXPIRED/PWDLIFETIME
/PWDMINIMUM/REMOTE/SFLAGS/S_RESTRICT/SHRFILLM
/TQELM/UIC/WSDEFAULT/WSEXTENT/WSQUOTA

 /[NO]ACCESS=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...])
 /[NO]ACCESS="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

 Used to specify hours of access for all modes of logins.  Specify hours
 as integers from 0 to 23, inclusive. Hours may be specified as single
 hours (n), or as ranges of hours (n-m).  If the ending hour of a range
 is earlier than the starting hour, the range extends from the starting
 hour through midnight to the the ending hour.  The first set of hours
 after the keyword PRIMARY specifies hours on primary days; the second
 set of hours after the keyword SECONDARY specifies hours on secondary
 days.

 All the list elements are optional.  If no hours are specified for a
 day type, access is permitted the entire day.  If only primary hours
 or only secondary hours are given, no access is permitted for secondary
 or primary days, respectively.  If hours are given with no day type, they
 apply to both types of days.

 Negating the qualifier by specifying /NOACCESS=(...) completely inverts
 the sense of the access hours.

 Examples:

 /ACCESS                allows unrestricted access
 /NOACCESS=SECONDARY    allows access on primary days only
 /ACCESS=(9-17)         allows access from 9 am through 5 pm on all days
 /NOACCESS=(PRIMARY, 9-17, SECONDARY, 18-8)
                        allows access from 9 through 5 on secondary days
                        and all but 9 through 5 on primary days
 /ACCESS="Primary: 9-16; Secondary: 18-7, 8; Primary: 17"
                        allows access from 9 through 5 on primary days
                        and all but 9 through 5 on secondary days

 To specify access hours for specific types of logins, see the
 /BATCH, /NETWORK, /INTERACTIVE, /LOCAL, /DIALUP, and /REMOTE qualifiers.

 /ACCOUNT=account-name

 Specifies a default account name.  This field is often used for billing
 purposes, and should consist of 1 through 8 characters.

 /ALGORITHM={CURRENT|PRIMARY|SECONDARY|BOTH|ALL}:{VMS|{CUSTOMER:n}}

 Modify the password hash algorithm for the specified passwords for
 the specified username.

 For each passsword, you can choose either to use the current VMS
 algorithm ('VMS') or one in the range of values 128-255.  The hash
 algorithm value is presented to the $HASH_PASSWORD system service by
 all VMS system software components and is used by $HASH_PASSWORD to
 determine which algorithm to use to hash the user's plaintext password.

 You must reset the user's password whenever you change to a different
 hash algorithm.

 /ASTLM=n

 Specifies the AST queue limit, which is the total number of asynchronous
 system trap operations and scheduled wakeup requests that can be
 outstanding at one time for the user.

 /[NO]BATCH=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...])
 /[NO]BATCH="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

 Specifies hours of access permitted for batch jobs. For a detailed
 description of the interpretation of the access specification, see the
 /ACCESS qualifier.

 /BIOLM=n

 Specifies the total buffered I/O operations that can be outstanding
 at one time.

 /BYTLM=n

 Total number of bytes that can be specified for transfer in
 outstanding buffered I/O operations.

 /CLI=cli-name

 Name of the default command interpreter.

 /CLITABLES=table-name

 Name of the default command interpreter tables.

 /CPUTIME=delta-time

 Maximum amount of CPU time a user process can take per session.  The
 unit of time must be in delta format.  0 means infinite.

 /DEFPRIVILEGES=([NO]privname [,...])

 Specifies the default privileges for the user (i.e., those enabled
 at login time).  A NO prefix removes this privilege from the user;
 specifying a privilege without the NO prefix allows the user that
 privilege.

 There are many privileges available with varying degrees of power and
 potential system impact.  Please see the Guide to Setting Up a VMS
 System for a more detailed discussion of the available  privileges.

 /DEVICE=device-name

 Name of default device (must be a direct access device) from one to
 fifteen characters.  The colon is automatically added if omitted.
 A blank device is interpreted as SYS$SYSDISK.

 /[NO]DIALUP=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...])
 /[NO]DIALUP="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

 Specifies hours of access permitted for interactive login via dialup
 terminals.  For a detailed description of the interpretation of the
 access specification, see the /ACCESS qualifier.

 /DIOLM=n

 Total direct (usually disk) I/O operations that can be outstanding at
 one time.

 /DIRECTORY=directory-name

 Name of default login directory.  Brackets (either [] or <>) must be
 supplied.

 /ENQLM=n

 Total number of lock requests which may be outstanding at one time.

 /EXPIRATION=time

 Expiration date and time of the account.  Specify as an absolute or
 combination time.

 /FILLM=n

 Total number of files that can be open at one time, including active
 network logical links.

 /FLAGS=([NO]option[,...])

 Login flags for this user.  Options which may be specified are:

        [NO]AUDIT      - [do not] audit all security relevant actions
        [NO]AUTOLOGIN  - [do not] restrict this account to autologins only
        [NO]CAPTIVE    - [do not] prevent user from changing any defaults
                                  at login and from escaping the captive
                                  login command procedure to the DCL level
        [NO]DEFCLI     - [do not] prevent user from changing default CLI
                                  or CLI tables
        [NO]DISCTLY    - [do not] disable <CTRL/Y> interrupts
        [NO]DISFORCE_PWD_CHANGE
                       - [do not] disable forced expired password changes
        [NO]DISMAIL    - [do not] prevent mail delivery to this user
        [NO]DISIMAGE   - [do not] prevent user from executing the RUN
                                  or MCR commands or from executing
                                  foreign commands at the DCL level
        [NO]DISNEWMAIL - [do not] suppress "New Mail..." announcements
        [NO]DISPWDDIC  - [do not] suppress dictionary-based password filter
        [NO]DISPWDHIS  - [do not] suppress history-based password filter
        [NO]DISRECONNECT-[do not] disable automated reconnections
        [NO]DISREPORT  - [do not] disable time of last login and other
                                  security reports
        [NO]DISUSER    - [do not] disable this account completely
        [NO]DISWELCOME - [do not] suppress "Welcome to..." login message
        [NO]GENPWD     - [do not] require user to use generated passwords
        [NO]LOCKPWD    - [do not] prevent user from changing password
        [NO]PWD_EXPIRED- [do not] mark password as expired
        [NO]PWD2_EXPIRED-[do not] mark second password as expired
        [NO]RESTRICTED - [do not] prevent user from changing any defaults
                                  at login

 /GENERATE
 /GENERATE=CURRENT
 /GENERATE=PRIMARY
 /GENERATE=SECONDARY
 /GENERATE=BOTH
 /GENERATE=ALL

 Generate a random password.  The formats of the passwords is the same
 as for the DCL SET PASSWORD /GENERATE command.

 /[NO]INTERACTIVE=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...])
 /[NO]INTERACTIVE="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n][,...]"

 Specifies hours of access permitted for interactive login via any
 terminal.  For a detailed description of the interpretation of the
 access specification, see the /ACCESS qualifier.

 /JTQUOTA=n

 Specifies the initial byte quota with which the job-wide logical name
 table is to be created with.

 /LGICMD=filespec

 Name of login command file.  Default device and directory are used to
 locate the command file.

 /[NO]LOCAL=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...])
 /[NO]LOCAL="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

 Specifies hours of access permitted for interactive login via local
 terminals.  For a detailed description of the interpretation of the
 access specification, see the /ACCESS qualifier.

 /MAXACCTJOBS=n

 Specifies the maximum number of batch, interactive and detached processes
 which may be active at one time for all users which are on the same
 account as the user for which the qualifier is present.

 /MAXDETACH=n

 Specifies the maximum number of detached processes with this username
 that may be active at one time.  Processes which cause this count to
 be exceeded are terminated.

 /MAXJOBS=n

 Maximum number of interactive, batch, and detached processes with this
 username which can be active at one time.  Processes which cause this
 count to be exceeded are terminated.

 /[NO]MODIFY_IDENTIFIER

 Controls whether the identifier corresponding to the specified username
 in the rights database is modified.  The default is /MODIFY_IDENTIFIER.

 /[NO]NETWORK=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...])
 /[NO]NETWORK="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

 Specifies hours of access permitted for network jobs.  For a detailed
 description of the interpretation of the access specification, see the
 /ACCESS qualifier.

 /OWNER=owner-name

 Name of owner for billing purposes, etc.  May be from one to 31 characters.

 /PASSWORD=(password [,password2])
 /NOPASSWORD

 Password(s) for login.  Must be from 0 to 32 characters in length, and
 must be composed of alphanumeric characters, dollar signs, and underscores.

 To set the first password with no second password, specify

            /PASSWORD=password

 To set both passwords, specify

            /PASSWORD=(password, password2)

 To set only the first password leaving the second alone, specify

            /PASSWORD=(password, "")

 To set only the second password leaving the first alone, specify

            /PASSWORD=("", password2)

 To clear the second password leaving the first alone, specify

            /PASSWORD=""

 To clear both passwords, specify

            /NOPASSWORD

 /PFLAGS=([NO]option[,...])

 This qualifier is obsolete and is retained for compatibility purposes.
 For current usage, see the /ACCESS, etc., qualifiers.
 Login flags for primary days.  Options are:

        [NO]DISDIALUP   - [do not] prohibit user from dialing in
        [NO]DISNETWORK  - [do not] prohibit user from logging in via a
                                        "SET HOST" command.

 /PGFLQUOTA=n

 Total pages that this process can use in the system paging file.  Should
 be a minimum of 2048 for a typical interactive process.

 /P_RESTRICT=(n-m[,...])

      or
 /P_RESTRICT=(n[,...])

 This qualifier is obsolete and is retained for compatibility purposes.
 For current usage, see the /ACCESS, etc., qualifiers.
 Used to specify hours or ranges of hours to restrict user from logging in on
 primary days.

 /P_RESTRICT=(...) is roughly equivalent to /NOACCESS=(PRIMARY, ...)

 /PRCLM=n

 Total number of subprocesses that can exist at one time.

 /PRIMEDAYS=([NO]day[,...])

 Used to define primary and secondary days.  A day prefixed with NO becomes
 a secondary day, and a day without the NO prefix is defined as a primary
 day.  Primary and secondary day definitions are used in conjunction with
 the /ACCESS, etc., qualifiers.

 /PRIORITY=n

 Default base priority for user.  The priority should be in the range from
 0 - 31, and 4 is the default for a timesharing user.

 /PRIVILEGES=([NO]privname[,...])

 Specifies authorized privileges for this user.  Privileges which are
 allowed or disallowed for this user.  A NO prefix removes this privilege
 from the user; specifying a privilege without the NO prefix allows the
 user that privilege.

 There are many privileges available with varying degrees of power and
 potential system impact.  Please see the Guide to Setting Up a VMS
 System for a more detailed discussion of the available  privileges.

 /[NO]PWDEXPIRED

 Password is [not] pre-expired.  When a password is pre-expired, the
 user is allowed to log in once, at which time he must change his
 password or be locked out of the system.

 /PWDLIFETIME=delta-time
 /PWDLIFETIME=NONE

 Password lifetime.  If the date of last password change is older than
 the password lifetime, when the user logs in, he is issued a warning
 message and the password is marked as expired.  If there is no password
 lifetime, then the password never expires.

 Delta-time is in the form: [dddd-] [hh:mm:ss.cc]

 /PWDMINIMUM=n

 Minimum password length in characters.  Note that this value is only
 enforced by the SET PASSWORD command; passwords in violation of this
 value may be specified to AUTHORIZE.

 /[NO]REMOTE=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...])
 /[NO]REMOTE="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

 Specifies hours of access permitted for interactive login via network
 remote terminals (i.e., SET HOST).  For a detailed description of the
 interpretation of the access specification, see the /ACCESS qualifier.

 /SFLAGS=([NO]option[,...])

 This qualifier is obsolete and is retained for compatibility purposes.
 For current usage, see the /ACCESS, etc., qualifiers.
 Login flags for secondary days.  Options are:

        [NO]DISDIALUP   - [do not] prohibit user from dialing in
        [NO]DISNETWORK  - [do not] prohibit user from logging in via a
                                        "SET HOST" command.

 /S_RESTRICT=(n-m[,...])

      or
 /S_RESTRICT=(n[,...])

 This qualifier is obsolete and is retained for compatibility purposes.
 For current usage, see the /ACCESS, etc., qualifiers.
 Used to specify hours or ranges of hours to restrict user from logging in on
 secondary days.

 /S_RESTRICT=(...) is roughly equivalent to /NOACCESS=(SECONDARY, ...)

 /SHRFILLM=n

 Maximum number of shared files allowed to be open at one time.

 /TQELM=n

 Total entries in the timer queue plus the number of temporary common
 event flag clusters that the user can have at one time.

 /UIC=uic

 User identification code as explained in the VMS DCL Concepts Manual
 The UIC should have an octal group number and user number, and be
 separated by a comma and enclosed in brackets.  The UIC group 0 is
 reserved to DIGITAL.

 /WSDEFAULT=n

 Initial limit of a working set for the user process.

 /WSEXTENT=n

 Maximum to which the user's process may raise its working set limit
 when there is free memory available.

 /WSQUOTA=n

 Maximum to which the user's process may raise the working set limit
 when system memory is in demand.