AD value userAccountControl not changed

Question

When I set the flag "User cannot change password" in the user settings of my active directory I would expect the value userAccountControl to change its value. But it doesn't. I start with that:

userAccountControl = 0x200 => NORMAL_ACCOUNT

If I set the flag "User cannot change password" I would expect this:

userAccountControl = 0x240 => NORMAL_ACCOUNT and PASSWD_CANT_CHANGE

But it is still the old value.
If I set the flag "Password never expires" then userAccountControl changes. But why isn't that working with "User cannot change password"?

Answer 1

That checkbox doesn't modify the userAccountControl attribute (on the 2008 DC that I checked on); instead, it adds Deny ACEs against the Change Password right for SELF and Everyone.