How to start DST without an IPL

This is a multipart message in MIME format.
--
[ Picked text/plain from multipart/alternative ]
V5R2

Trying to change the SST password.  I signed on as QSECOFR and ran:
CHGDSTPWD PASSWORD(*DEFAULT)
Then I did STRSST, signed on as QSECOFR/QSECOFR and it told me it was
expired.  Therefore I pressed F9 to change the password.  I entered in the
old and new passwords and got:
CPF4AB7
Message . . . . :   Service tools user ID password cannot be changed.
Cause . . . . . :   Your system is configured to prevent a service tools
user
  ID with a default and expired password from changing its own password.

Recovery  . . . :   Either change the password of the service tools user
ID
  through DST or use the Start Service Tools (STRSST) command, select the

  option to work with system security, and enable service tools user ID
with a
  default and expired password to change its own password. Try the request

  again.

Therefore I would like to start DST without an IPL.  I've got one machine
I can play with that no one would notice.  Isn't it something like 21 on
the front panel?

Or, the above message alludes to maybe I can configure my system to allow
a service tool user to change it's own password.  How do I do that?

Rob Berendt
--
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
Benjamin Franklin