It is not easy to block most of these things while the role has S rights to user objects or C rights to a container. The only exception to the above is also main reason why S right is issued at all. Novell Passwords can be changed and the intruder detect lockout after multiple password attempt failures can be reset. Using CRUX to fix these is preferred as the password change can be co-ordinated across all the services the user has access to. Changing the password to Novell access will not help them remember it for other services.
Profile is a special case.
Properties of user accounts an MGR must not touch for operational issues. In all cases, the property values must be consistent with agreed and published ITS policy. In principle, any data field can not be filled in unless there is a process to keep it valid across the entire NDS tree. NDS Objects in general Do not create volumes, servers, containers, users, groups or organizational units. Do not attempt to modify the NDS schema.