Is it possible to use the Blackberry handheld configuration tool to manually set security settings like restricting whether or not the Password can be changed by the user. Can those settings be managed from the handheld itself?

I know that it's possible by IT policy and that is the preferred method but when that is not an option what can I try.

You need IT Policy for that but why/when wouldn't it be an option? If the device is live and connected to the BES, policy should work.