It is set on the using the ALTUSER or ADDUSER command:
Today, the "correct" way to handle this is not by running a sidchg command after the fact, but by preparing the image correctly before cloning. sidchg key
ALTUSER BATCHSVC SIDCHG
Without sidchg , RACF will challenge the user for a password/passphrase when such a change is attempted. It is set on the using the ALTUSER
The workflow looked like this:
Different keys may be required for specific architectures, such as Windows x64/x86 versus Windows ARM64 . How to Use the Key sidchg key