Hi Mark,
I think if you change it in the base system lucee-web.xml.cfm it will copied to new hosts when they are created as I believe it uses the base one as the template when creating new ones. So if you used the installer this would be:
{basedir}/tomcat/webapps/ROOT/WEB-INF/lucee/lucee-web.xml.cfm
I must say I've not tried this but I think that is how it works.
If you are just trying to stop people from accessing the Lucee Admin I would suggest using rewrite rules on your web server (Apache, Nginx, etc...) instead and return a 404 for the admin except for specific IP addresses. If you want some help with that feel free to contact me off list.