Deny changing root password in Restricted SAM

[Restricted SAM]

How do you give your helpdesk rights though Restricted SAM on HP-UX 11.11 to change user passwords, but prevent them from changing root or other system accounts?

[A. Clay Stephenson]

How do I do it with SAM restricted or not? I don't. I write my own password manipulation tools.

[Marlou Everson]

Set up a custom area in Restricted SAM to run a script in /usr/sam/lbin that does something along the lines of

/bin/echo 'Enter username: ' \
&& read input && echo $input | grep -vq -e root -e adm -e bin \
&& /bin/passwd $input && echo "Changed" || echo "NOT changed"

Modify the grep appropriately and test it.

Marlou