ignore sddav and sddci if they exist
take a stab at disallowing pwd change and group editing by default (for sdidemo)