---
name: "pam_acct_mgmt"
section: "3"
platform: "linux"
package: "pam"
version: "1.7.3-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "freebsd", "macos"]
url: "https://new.carta.tech/pam_acct_mgmt"
---

# pam\_acct\_mgmt(3)

PAM account validation management

## NAME

pam\_acct\_mgmt - PAM account validation management

## SYNOPSIS

```
#include <security/pam_appl.h>
```

**int pam\_acct\_mgmt(pam\_handle\_t \****pamh***, int** *flags***);**

## DESCRIPTION

The **pam\_acct\_mgmt** function is used to determine if the user's account is valid. It checks for authentication token and account expiration and verifies access restrictions. It is typically called after the user has been authenticated.

The *pamh* argument is an authentication handle obtained by a prior call to pam\_start(). The flags argument is the binary or of zero or more of the following values:

PAM\_SILENT

Do not emit any messages.

PAM\_DISALLOW\_NULL\_AUTHTOK

The PAM module service should return PAM\_NEW\_AUTHTOK\_REQD if the user has a null authentication token.

## RETURN VALUES

PAM\_ACCT\_EXPIRED

User account has expired.

PAM\_AUTH\_ERR

Authentication failure.

PAM\_NEW\_AUTHTOK\_REQD

The user account is valid but their authentication token is *expired*. The correct response to this return-value is to require that the user satisfies the **pam\_chauthtok()** function before obtaining service. It may not be possible for some applications to do this. In such cases, the user should be denied access until such time as they can update their password.

PAM\_PERM\_DENIED

Permission denied.

PAM\_SUCCESS

The authentication token was successfully updated.

PAM\_USER\_UNKNOWN

User unknown to password service.

## SEE ALSO

[**pam\_start**(3)](/pam_start/3.md), [**pam\_authenticate**(3)](/pam_authenticate/3.md), [**pam\_chauthtok**(3)](/pam_chauthtok/3.md), [**pam\_strerror**(3)](/pam_strerror/3.md), [**pam**(8)](/pam/8.md)