We run a multi-directory environment (AD and OpenLDAP) and perform password synchronization via an internal webapp. This works well because we've disabled users from changing their own password via OpenLDAP and AD could only be accessed by the few services that require AD.
However, we are now looking into allowing PC's to attach to the AD domain. Initially, I believed that disabling password change for users would be as simple as changing the initial userAccountControl LDAP attribute we assign during account provisioning. This proved to not be as simple as I assumed.
We currently use Python and python-ldap for account provisioning (code below), Per Microsoft docs, we set userAccountControl to 66048 (Normal account and don't expire password). I tried changing it to 66112 (66048 + Disable user password change) but AD did not retain that value and instead, recorded it as 66048.
Has anyone done something like this before? I'd prefer to accomplish it either by using Python or a set-it-and-forget-it setting on AD.
FYI: This is how the account provisioning Python code looks like right now:
import ldap l = ldap.initialize(server) l .simple_bind_s(admin_cn, admin_pass) attributes = [ ('displayName', login), ('sAMAccountName', login), ('cn', login), ('givenName', fn), ('sn', ln), ('name', full_name), ('userPrincipalName', '%email@example.com' % login), ('objectClass', ['person', 'top', 'organizationalPerson', 'user']), ('userAccountControl', '66048'), # <--- Line I thought I could change but not working as expected ('unicodePwd', encoded_password) ] l.add_s( 'cn=%s,ou=users,dc=example,dc=com' % login, attributes, )