Can only administrator change a user’s first and last name?

Depending on the user’s role and permissions, the user can change users’ account information (e.g., first and last name), modify password settings, or add attachments to their accounts.

To edit user data, a role should hold the following permission: Change other user’s personal information (Permission 14)

If you do not want users with other roles (e.g., instructors) to be able to change users’ personal information, you need to turn off the above-mentioned permission for those roles. To see how you can manage roles and permissions, please see this link, or watch this video.