WebSphere ND Primary FID (wasinternaluser) should disable in console (not from backend)

We are the internal WebSphere ND engineering team at Citi, responsible for automating end-to-end installations across the global Citi network, encompassing over 10,000 servers. Approximately one year ago, Citi's security team raised concerns regarding the privileged status of the primary ID (wasinternaluser), prompting its restricted login access. Operational activities now utilize other user IDs authenticated via AD LDAP, with passwords managed through SyberArk for proper incident and change request handling. However, there remains a critical concern that users can still decrypt the wasinternaluser password and access the console without adequate justification, potentially performing operational activities in production environments. Therefore, we are actively seeking a feature or solution to disable console login specifically for the primary ID (wasinternaluser), while maintaining backend functionality for tasks such as stop/start/sync and wasadmin.shexecution under the same ID.

We currently have a risk exception (RE) in place for this issue, requiring us to deliver a solution within 3 to 4 months. Failure to do so may lead Citi's Security team to consider alternative products, potentially impacting IBM's position, as it involves migrating over 10,000 servers and installations from WebSphere ND. Therefore, we are urgently seeking a robust solution. If necessary, let's schedule a call to discuss further, referencing our previous CAS number.