I've got one machine where I want everyone to have the same profile, and no one but me can change it. What I did was make a shared profile ([tt]/etc/.shared_profile[/tt]), gave it appropriate permissions ([tt]rwxr-xr-x[/tt]), then each person only has a link to it in their home directory. That happens like...
[tt]
ln -s /etc/shared_profile ~username/.profile
[/tt]
This way if you need to make a change in the .profile, you change it just once and it's changed for everyone. I did allow for individual customization. The shared .profile has a line toward the end in it...
[tt]
[[ -f .my_profile ]] && . .my_profile
[/tt]
That way, if a user creates a file in their home directory called [tt].my_profile[/tt], it will execute it at login. This lets them add their own aliases or personal PATH additions without having to mess with the shared .profile.
Keep in mind that there is a [tt]/etc/profile[/tt] that they all execute. This would only be used if you have a small subset of users that you want a specific .profile for them.
Hope this helps.