Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We run a multi-directory environment (AD and OpenLDAP) and perform password synchronization via an internal webapp. This works well because we've disabled users from changing their own password via OpenLDAP and AD could only be accessed by the few services that require AD.

However, we are now looking into allowing PC's to attach to the AD domain. Initially, I believed that disabling password change for users would be as simple as changing the initial userAccountControl LDAP attribute we assign during account provisioning. This proved to not be as simple as I assumed.

We currently use Python and python-ldap for account provisioning (code below), Per Microsoft docs, we set userAccountControl to 66048 (Normal account and don't expire password). I tried changing it to 66112 (66048 + Disable user password change) but AD did not retain that value and instead, recorded it as 66048.

Has anyone done something like this before? I'd prefer to accomplish it either by using Python or a set-it-and-forget-it setting on AD.

FYI: This is how the account provisioning Python code looks like right now:

import ldap

l = ldap.initialize(server)
l .simple_bind_s(admin_cn, admin_pass)

attributes = [
    ('displayName', login),
    ('sAMAccountName', login),
    ('cn', login),
    ('givenName', fn),
    ('sn', ln),
    ('name', full_name),
    ('userPrincipalName', '%s@example.com' % login),
    ('objectClass', ['person', 'top', 'organizationalPerson', 'user']),
    ('userAccountControl', '66048'), # <--- Line I thought I could change but not working as expected
    ('unicodePwd', encoded_password)
]

l.add_s(
    'cn=%s,ou=users,dc=example,dc=com' % login,
    attributes,
)
share|improve this question
    
The following article might get me started. I will check it out at work on Tuesday. Too bad I cannot offer a bounty on this one heh: msdn.microsoft.com/en-us/library/aa746398.aspx –  Beaming Mel-Bin Oct 18 '10 at 1:34
    
Were you able to adapt your scripts to accommodate the procedure outlined in your above link? –  Stemen Dec 6 '10 at 7:22
    
I tested the script on one user and that did work. However, I wanted to see if anyone was aware of a configuration change that would disable password changing by default. Or, a Python solution. –  Beaming Mel-Bin Dec 6 '10 at 7:29
add comment

4 Answers

up vote 0 down vote accepted
+50

I am not a Windows admin, but isn't this exactly the sort of thing that a Group Policy is for? A brief Google search yields http://support.microsoft.com/kb/309799, which seems to do almost exactly what you want. This would be the "set-it-and-forget-it" model.

Also, this vbscripts purports to do what you want.

share|improve this answer
2  
The Group Policy mentioned, while useful in some circumstances, only removes the ability to change one's own password from within the Windows GUI. It doesn't remove the ability to do so via scripting or any other method. –  Jeff McJunkin Dec 8 '10 at 18:10
    
Huh. Now I've learned something new. –  larsks Dec 8 '10 at 18:11
add comment

From the documents that you linked:

PASSWD_CANT_CHANGE

Note: You cannot assign this permission by directly modifying the UserAccountControl attribute. For information about how to set the permission programmatically, see the "Property flag descriptions" section.

And the property flag descriptions:

PASSWD_CANT_CHANGE - The user cannot change the password. This is a permission on the user's object.

Or in other words, that specific bit in the bitmask cannot be set, and is returned after calculating the permissions on the user object.

Also linked from that document is http://msdn.microsoft.com/en-us/library/aa746398.aspx, which describes how to programatically adjust permissions on user objects.

What you're looking to do is deny the SELF pseudo-user access to change the password. The best way to do this would be configure permissions on an entire OU to restrict password changes. From here, move all of the relevant user objects into this OU and ensure that the user objects are inheriting their permissions from the OU.

If you're having issues with setting the security, ensure that you have Advanced Features enabled in ADUC (View --> Advanced Features).

share|improve this answer
add comment

Similar to maniargaurav's solution, but you can do this programmatically using PowerShell (if it's Server 2008 R2 or using the Qwest AD cmdlets link text) or VBscript. If you're using Python now, you should have no issue enumerating all users and doing a script such as the following (from Scripting Guy at MS) link text.

share|improve this answer
add comment

I am not sure how you can achieve this using program but in Active Directory User and Computers. Select User and go to properties. There is Option of "User cannot change password" option.

You can also check following URL if that would help:

http://msdn.microsoft.com/en-us/library/ms680832(VS.85).aspx

share|improve this answer
1  
That's the whole point - the OP doesn't want to have to do this for each new user. –  Ben Pilbrow Dec 7 '10 at 17:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.