Oracle Database / Accounts, Security & Access
ORA-28002: handle password-expiry grace warnings before an outage
A grace warning may not stop today's login but can become a service failure later. Inspect account policy and plan rotation ahead of expiry.
Environment and inputs: Oracle Database 19c baseline · SQL*Plus-compatible SQL unless RMAN, DGMGRL, ADRCI or a host shell is specified. Check release, patch level, edition and container first.
Start with this diagnostic
Use the stated SQL, RMAN, DGMGRL or host shell and replace sample names with approved targets. DBA and V$ views need authorized catalog access in the correct container. Do not grant broad privileges for an example.
SELECT username, account_status, expiry_date, profile FROM dba_users WHERE username = 'APP_USER';Read the result
The account status and expiry date need interpretation with profile settings and the current container. A successful login does not mean no action is required.
Resolve and verify
Schedule secure rotation with the application owner and confirm every consumer updates. Monitor the account until the warning clears through the proper process.
Operational precautions
Do not ignore the message or remove all profile controls to suppress it.