/FLAGS=([no]keyword[,...])

    Specifies several attributes of the DCE account. The
    keywords you can specify are:

       Keyword         Description

       ACCOUNT_VALID   A flag that is set to determine account
                       validity. An account without this flag set
                       is invalid and cannot log in.

                       The default is ACCOUNT_VALID.

       CLIENT          A flag that is set to indicate whether or
                       not the account is for a principal that
                       can act as a client.

                       The default is CLIENT.

       DUPLICATE_KEYS  A flag that is set to determine if tickets
                       issued to the account's principal can have
                       duplicate keys.

                       The default is NODUPLICATE_KEYS.

       FORWARDABLE_    A flag that is set to determine whether a
       CERTIFICATES    new ticket-granting ticket with a network
                       address that differs from the present
                       ticket-granting ticket network address can
                       be issued to the account's principal. (The
                       Proxiable Certificate Flag performs the
                       same function for service tickets.)

                       The default is FORWARDABLE_CERTIFICATES.

       PASSWORD_VALID  A flag that is set to determine whether
                       the current password is valid. If this
                       flag is not set, the next time the
                       principal logs in to the DCE account,
                       the system prompts the principal to change
                       his password.

                       The default is PASSWORD_VALID.

       POSTDATED_      A flag that is set to determine if tickets
       CERTIFICATES    with a start time some time in the future
                       can be issued to the account's principal.

                       The default is NOPOSTDATED_CERTIFICATES.

       PROXIABLE_      A flag that is set to determine whether or
       CERTIFICATE     not a new ticket with a different network
                       address than the present ticket can be
                       issued to the account's principal. (The
                       Forwardable Certificate Flag performs
                       the same function for ticket-granting
                       tickets.)

                       The default is NOPROXIABLE_CERTIFICATE.

       RENEWABLE_      A flag that is set to determine if the
       CERTIFICATE     ticket-granting ticket issued to the
                       account's principal can be renewed.If this
                       flag is set the authentication service
                       renews the ticket-granting ticket if its
                       lifetime is valid.

                       The default is RENEWABLE_CERTIFICATE.

       SERVER          A flag that is set to indicate whether or
                       not the account is for a principal that
                       can act as a server.

                       The default is SERVER.

       TGT_            A flag that is set to determine whether
       AUTHENTICATION  or not tickets issued to the account's
                       principal can use the ticket-granting
                       ticket authentication mechanism.

                       The default is TGT_AUTHENTICATION.