If the user is LMTCPB(*NO) then they can type in a new program name on the Sign On panel. The change would only be for the current session, but typing in a program name of QCMD will get them to the command line. If this is a concern you may want to look at LMTCPB(*PARTIAL).
They can also change the menu on the Sign On panel, but the *USRRPF initial program will override that.
Bruce Vining Services