Need to remove nullok from system-auth-ac

I am interested in finding out how to remove nullok from the system-auth-ac file.  I work indirectly for the DLA and it is a catagory I security violation to allow null passwords.  Since this file gets autogenerated each time authconfig is run, how can I make it so that whenever it is run it doesn't include the nullok in the line:

password           sufficient             pam_unix.so    sha=512   shadow   nullok   try_first_pass  use_authtok

How is system-auth-ac generated?

Does it start from a template?

Thanks