/FLAGS=([no]keyword[,...])

    Specifies several attributes of the DCE account. The
    keywords you can specify are:

 	Keyword		Description

 	ACCOUNT_VALID   A flag that is set to determine account
                         validity. An account without this flag set
                         is invalid and cannot log in.

                         The default is ACCOUNT_VALID.

 	CLIENT          A flag that is set to indicate whether or
                         not the account is for a principal that
                         can act as a client.

                         The default is CLIENT.

 	DUPLICATE_KEYS  A flag that is set to determine if tickets
                         issued to the account's principal can have
                         duplicate keys.

                         The default is NODUPLICATE_KEYS.

 	FORWARDABLE_    A flag that is set to determine whether a
         CERTIFICATES    new ticket-granting ticket with a network
                         address that differs from the present
                         ticket-granting ticket network address can
                         be issued to the account's principal. (The
                         Proxiable Certificate Flag performs the
                         same function for service tickets.)

                         The default is FORWARDABLE_CERTIFICATES.

 	PASSWORD_VALID  A flag that is set to determine whether
                         the current password is valid. If this
                         flag is not set, the next time the
                         principal logs in to the DCE account,
                         the system prompts the principal to change
                         his password.

                         The default is PASSWORD_VALID.

 	POSTDATED_      A flag that is set to determine if tickets
         CERTIFICATES    with a start time some time in the future
                         can be issued to the account's principal.

                         The default is NOPOSTDATED_CERTIFICATES.

 	PROXIABLE_      A flag that is set to determine whether or
         CERTIFICATE     not a new ticket with a different network
                         address than the present ticket can be
                         issued to the account's principal. (The
                         Forwardable Certificate Flag performs
                         the same function for ticket-granting
                         tickets.)

                         The default is NOPROXIABLE_CERTIFICATE.

 	RENEWABLE_      A flag that is set to determine if the
         CERTIFICATE     ticket-granting ticket issued to the
                         account's principal can be renewed.If this
                         flag is set the authentication service
                         renews the ticket-granting ticket if its
                         lifetime is valid.

                         The default is RENEWABLE_CERTIFICATE.

 	SERVER          A flag that is set to indicate whether or
                         not the account is for a principal that
                         can act as a server.

                         The default is SERVER.

 	TGT_            A flag that is set to determine whether
         AUTHENTICATION  or not tickets issued to the account's
                         principal can use the ticket-granting
                         ticket authentication mechanism.

               		The default is TGT_AUTHENTICATION.