What does ADDUSER do?

A RACF command that creates a new user ID, with a name, a group and a first password.

ADDUSER

Creates a new user ID in RACF.

Also written AU

Why it matters. Nobody can sign on until someone adds them. ADDUSER is how a new colleague gets in.

See it

Read it left to right

ADDUSER: Make a new user
ZED: Their user ID
NAME('ZED'): The name on the account
PASSWORD(SYS1): What they first log in with
SPECIAL: Full control of RACF

Syntax

{ADDUSER | AU} userid [NAME('user-name')] [PASSWORD(password) | PHRASE('passphrase')] [DFLTGRP(group)] [OWNER(userid | group)]
ADDUSER userid ... [AUTHORITY(USE | CREATE | CONNECT | JOIN)] [SPECIAL] [OPERATIONS] [AUDITOR] [CLAUTH(class ...)]

userid: The new user ID. It comes first and must not exist already.
NAME('name'): The person's name, in quotes.
PASSWORD(pw): The first password. RACF marks it expired, so the user must change it at first sign-on. Leave it out and the user has no password.
PHRASE('text'): A password phrase instead of a password, in quotes.
DFLTGRP(group): The group the user signs on into. If you leave it out, it is your current connect group.
OWNER(id): Who owns the profile. If you leave it out, you do.
AUTHORITY(level): The user's level in the default group. USE if you leave it out.
SPECIAL, OPERATIONS, AUDITOR: System-wide powers. You need SPECIAL yourself to give them. Give them rarely.

Try it ADDUSER

1
Create a user ZB0002, named NEW TELLER, with the first password TEMP1.
ADDUSER ZB0002 NAME('NEW TELLER') PASSWORD(TEMP1)
2
Check that RACF knows ZB0002 now.
LISTUSER ZB0002
3
Try to add ZB0002 a second time.
ADDUSER ZB0002 NAME('NEW TELLER') PASSWORD(TEMP1)

ZedBank practice system

READY

Nothing here is saved

Remember

The user ID comes right after ADDUSER.
PASSWORD sets a first password. The user changes it at first sign-on.
Success is silent. Check with LISTUSER.

The usual mistake

ADDUSER ZB0002 NAME('NEW TELLER')

With no PASSWORD or PHRASE, the user is created with no password. They cannot sign on.

ADDUSER ZB0002 NAME('NEW TELLER') PASSWORD(TEMP1)

On real z/OS

MF/OS stores the base profile only. The segment operands (TSO, OMVS, CICS and so on) and CLAUTH are not modelled. Real ADDUSER prints nothing on success, so MF/OS adds a 'Mainframe101 sim:' note. For a user ID that already exists, MF/OS prints IKJ56702I INVALID USERID with a note, and the wording on a real system may differ.

Where can I practise ADDUSER?

Right here, at ZedBank. You take a junior job at a simulated bank and use ADDUSER in real work, with Zed beside you. There's nothing to install.

Start at ZedBank