There is a chance the expire dates are 'misaligned' due to a previous bug in an earlier version.
You can run ./rsautil sync-tokens -I on the command line in /opt/rsa/am/utils and choose to reset shutdown date. This would correct any discrepancies if the discrepancy was due to the seed record being imported on an earlier version and getting an incorrect expire date.
rsaadmin@am81-intel-a250-1:/opt/rsa/am/utils> ./rsautil sync-tokens -I
Authenticator Bulk Synchronization Utility 8.3.0.0.0 (1397825)
Copyright (C) 1994-2018 Dell Inc. or its subsidiaries. All Rights Reserved.
Enter the absolute path for the output report file : /tmp/sync.txt
Enter the base security domain name for recursive search [(none)]:
Enter the type of token selection [ (all) | file ]: all
Choose a token filter [ assigned | unassigned | (both) ]: both
What action do you wish to perform? [ (list) | modify ]: modify
Enter type of clock offset value [ absolute | relative | (none)]: absolute
Enter clock offset value [0]: 0
Do you want to reset the Next Tokencode Mode? [ y/n ]: n
Do you want to reset the last login date and time? [ y/n ]: n
Do you want to clear user lockout information? [ y/n ]: n
Do you want to reset the shutdown date? [ y/n ]: y
Enter administrator user ID : admin
Enter administrative password : *********
If this does not correct the issue, then examine the original seed record that was use to import the token to the system with a text editor, and check the expiration dates inside.
example:
</TKNHeader>
<TKN>
<SN>116033640</SN>
<Seed></Seed>
<Birth>2011/01/18</Birth>
<Death>2021/02/28</Death>
<TokenMAC></TokenMAC>
</TKN>
<TKN>
<SN>116033641</SN>
<Seed></Seed>
<Birth>2011/01/18</Birth>
<Death>2021/02/28</Death>
<TokenMAC></TokenMAC>
