Active Directory Cookbook

6.20. Preventing a User from Changing His Password

Problem

You want to disable a user’s ability to change his password.

Solution

Using a graphical user interface

1. Open the Active Directory Users and Computers snap-in.

2. In the left pane, right-click on the domain and select Find.

3. Select the appropriate domain beside In.

4. Beside Name, type the name of the user you want to modify and click Find Now.

5. In the Search Results, double-click on the user.

6. Click the Account tab.

7. Under Account options, check the box beside User cannot change password.

8. Click OK.

Using a command-line interface

> dsmod user <UserDN> -canchpwd no

Using VBScript

' This code disables a user's ability to change password
' ------ SCRIPT CONFIGURATION ------
strUserDN = "<UserDN>" ' e.g. cn=rallen,ou=Sales,dc=rallencorp,dc=com ' ------ END CONFIGURATION --------- Const ACETYPE_ACCESS_DENIED_OBJECT = 6 Const ACEFLAG_OBJECT_TYPE_PRESENT = 1 Const RIGHT_DS_CONTROL_ACCESS = 256 Const CHANGE_PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}" set objUser = GetObject("LDAP://" & strUserDN) set objSD = objUser.Get("ntSecurityDescriptor") set objDACL = objSD.DiscretionaryAcl ' Add a deny ACE for Everyone set objACE = CreateObject("AccessControlEntry") objACE.Trustee = "Everyone" objACE.AceFlags = 0 objACE.AceType = ACETYPE_ACCESS_DENIED_OBJECT objACE.Flags = ACEFLAG_OBJECT_TYPE_PRESENT objACE.ObjectType = CHANGE_PASSWORD_GUID objACE.AccessMask = RIGHT_DS_CONTROL_ACCESS objDACL.AddAce objACE ' Add a deny ACE for Self set objACE = CreateObject("AccessControlEntry") ...