Overriding Entries in the Local Registry
You can override registry entries for local machines. By using overrides, you can, for example, prevent individuals and groups from logging into a particular machine, establish local root passwords, and tailor local user environments. The override information is in effect for the local machine only and has no effect on the account information that is stored in the registry.
The override mechanism provides a high level of local autonomy and allows individual users to control their own machines. For example, an administrator who is responsible for a group of machines can use the override facility to restrict access to those machines. The administrator can allow access to specific groups, or the administrator can allow access to everyone except specific groups or principals.
More:
The passwd_override File Format
The group_override File Format
Creating Override File Entries
Leaving passwd_override File Fields Blank
Specifying Passwords for a Specific Machine
Omitting Users from the Local Password Files
Specifying a Home Directory and Login Shell for a Machine
Overriding a Principal's Group Affiliation
Applying Overrides to All Members of a Group
How passwd_override Handles Multiple Override Entries