*SECADM change QSECOFR password?

[D.BALE@xxxxxxxxxxxxx]

We set up a user profile (UKHELP) at one of our international branches whose
sole purpose is to reset passwords and re-enable profiles for profiles that
got disabled due to too many invalid attempts to sign on.

This works fine except that this user profile has the ability to change the
QSECOFR profile as well.  How can we prevent that?  Following are pertinent
bits & pieces from the UKHELP profile:
  User class . . . . . . . . :   *SECADM
  Special authority  . . . . :   *SECADM
  Group profile  . . . . . . :   SECADM
  Owner  . . . . . . . . . . :   *USRPRF
  Group authority  . . . . . :   *NONE
  Group authority type . . . :   *PRIVATE
  Supplemental groups  . . . :   *NONE
  Initial program  . . . . . :   SEC612R
    Library  . . . . . . . . :     *LIBL
  Initial menu . . . . . . . :   MAIN
    Library  . . . . . . . . :     *LIBL
  Limit capabilities . . . . :   *NO

Following are pertinent bits & pieces from the QSECOFR profile:
  User class . . . . . . . . :   *SECOFR
  Special authority  . . . . :   *ALLOBJ
                                 *AUDIT
                                 *IOSYSCFG
                                 *JOBCTL
                                 *SAVSYS
                                 *SECADM
                                 *SERVICE
                                 *SPLCTL
  Group profile  . . . . . . :   *NONE
  Owner  . . . . . . . . . . :   *USRPRF
  Group authority  . . . . . :   *NONE
  Group authority type . . . :   *PRIVATE
  Supplemental groups  . . . :   *NONE
  Initial program  . . . . . :   *NONE
    Library  . . . . . . . . :
  Initial menu . . . . . . . :   MAIN
    Library  . . . . . . . . :     *LIBL
  Limit capabilities . . . . :   *NO

FWIW, DSPPGM SEC612R (UKHELP's initial program) shows "Use adopted authority:
= *YES"

TIA!

- Dan
Dan Bale says "Ban Dale!"
IT - AS/400
Handleman Company
248-362-4400  Ext. 4952
D.Bale@Handleman.com
  Quiquid latine dictum sit altum viditur.
  (Whatever is said in Latin seems profound.)
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---