Later VMS releases (7.3?) has by-user option for PDC password validation, instead of using SYSUAF file. May not help if you also throw "real" Unix boxes into the site mix too.