Is there any way to prevent LDAP users from being able to change the passwords of the local FOG users?

Essentially, I want all of our technicians and admins to use their LDAP accounts to work with FOG and have a single local breakglass account that is only known by sysadmins in the event that LDAP stops working.