I have been a long time away from novell (stopd with 5) but if I remember correctly isn't Consoleone on the server only...if so its real easy to restrict user access, a lock and key.
As for NTadm32 ther is a file acces list much like win 2k's ACL and with that you can set the privalges to acces a file (I think this is done through zenworks). If you asked this question in the mid 90's I would have been a lot more help