You can do this "On Mass" like this:WRKUSRPRF *ALL
Place a 2 "Change" beside all the profiles you want to change.
Type this on the command line and press Enter.
Now Limit capabilities on all the selected profiles will be chagned to *YES
Limit capabilities (LMTCPB) - Help
Specifies the limit to which the user can control the program, menu,
current library, and the ATTN key handling program values. It also
determines whether the user can run commands from a command line.
This parameter is ignored when the security level is 10.
Note: When creating or changing other users' user profiles, you
cannot specify values on this parameter that grant greater
capabilities to other users than your own user profile grants to
you. For example, if *PARTIAL is specified for the Limit
capabilities (LMTCPB) parameter in your user profile, you can
specify *PARTIAL or *YES for another user. You cannot specify
*NO for another user.
The program, menu, and current library values cannot be changed
on the sign-on display. Commands cannot be run when issued from
a command line or by selecting an option from a command grouping
menu such as CMDADD, but can still be run from a command entry
screen. The user cannot change the program, menu, current
library, or the ATTN key program handling values by using the
For completeness, LMTCPB(*YES) doesn't restrict access to command lines nor does it stop users from entering and executing commands. Rather, it stops users from executing commands that do not have the ALWLMTUSR(*YES) attribute set. Commands such as DSPMSG and DSPJOB are still available. A half dozen or so commands are set by default from IBM. Any other command that has had the attribute set has also been made available. (Subject to authorities.)