See the RLPF exec on R (Local tools) disk.
-----------------------------------------------------------------------
  Using RLPF, you can change the "MDisk address/class" field to
"SUR" (isn't that obvious?), and the "MDisk/class owner ID" field,
to change who can logon to that userid.
-----------------------------------------------------------------------
  Using RACFVM, hitting PF2 once will get you the two additional
"Group Administrator Commands".  Hitting PF2 a second time will get
you the 7 additional "System Administrator Commands".
 
  Among those 7 additional "System Administrator Commands" is # 11,
ALTUSER, which will "Set an expired pw for a user and issue a resume",
something you need to do when an id gets "revoked".  Type "11", give
the userid and new password.  The "resume" is done automatically.
 
-----------------------------------------------------------------------
To define a RACF resource with a profile (according to page 6-14 in
the RACF Security Administrator's guide), which is something you have
to do when you add a new minidisk, type in this command
       exec rac rdefine vmmdisk haeckel.300 uacc(none)
 
When Rick then tried to get to that disk, he got a "not authorized"
error message.  You've also got to type in this command.
       exec rac
 
-----------------------------------------------------------------------
  MVS user data is collected by an MVS program, shipped over to VM
to VMSERVE at ALMVMA,
and put on the ADMIN 191 disk as MVSUSERS DATA.
The procedure is started by the MVSUSERS member of SYS2.SOF.CNTL.
The program that runs is LUSTAR3, a PL/I program whose source is
in ACCOUNT.ACCOUNT.PLI.
 
  When a new MVS user get added, Ellie puts some information in the
"User Data" field, aka the "RACF Installation Data" field.  This field
is free form text, 80 characters per line, that an installation can use
any way they wish.  We've chosen to put (among other things) the
employee serial number, preceeded by the keyword, EMP.  Sometimes, this
keyword and the following serial number gets split between two lines.
When this happens, the MVS (PL/I?)  program that extracts this data and
ships it over to VM doesn't find the serial number and leaves that field
blank.  To fix this situation, have one of the MVS folks go in and
manually modify the field.