Hi
1. RSEC_GENERATE_PASSWORD is doing 1000 loop with check FM PASSWORD_FORMAL_CHECK.
2. One of the parameters for RSEC_GENERATE_PASSWORD and PASSWORD_FORMAL_CHECK is SECURITY_POLICY.
You can use system default (set by parameters) or modified policy (SECPOL since EHP6).
3. RSEC_GEN_PASSWD have no arguments for any policy check.
So forbidden password patterns can't be effectively checked by RSEC_GEN_PASSWD.
Reards
Przemek