I was able to remove this by overwriting the attribute
"ipa user-mod --setattr krblastadminunlock= waynev"
ipa user-show --all --raw waynev | grep -i krblastadminunlock
I’ll have the user test and we’ll see if this resolves the 'no ssh login to IPA servers' issue for this user.
If it’s a no, I will change his password.