Modifying Cross-Cell Authentication Accounts

Never set the account's pwdvalid attribute to no (invalid). For standard accounts, setting the attribute to no causes the user to be prompted to change their passwords at the next login. Passwords for cross-cell authentication accounts, however, are shared by the authentication services in two cells. If you change one, this synchronization is destroyed and cross-cell communications end. If you want to change the passwords that are shared by the authentication services, you must rerun the registry connect command to recreate the accounts and create the properly synchronized passwords.

Generally, do not delete the accounts or the account's principals unless you are breaking the peer-to-peer relationship with the cell. If one of the accounts is deleted, you must run the registry connect command to recreate both accounts and restore the peer-to-peer relationship.