Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I set the flag "User cannot change password" in the user settings of my active directory I would expect the value userAccountControl to change its value. But it doesn't. I start with that:

userAccountControl = 0x200 => NORMAL_ACCOUNT

If I set the flag "User cannot change password" I would expect this:

userAccountControl = 0x240 => NORMAL_ACCOUNT and PASSWD_CANT_CHANGE

But it is still the old value.
If I set the flag "Password never expires" then userAccountControl changes. But why isn't that working with "User cannot change password"?

share|improve this question
What makes you think that the useraccountcontrol attribute reflects password permissions? – Jim B Dec 5 '11 at 17:34
@JimB: this site indicates that:… – juergen d Dec 6 '11 at 11:02
ahh, ok you must have missed the line on update frequency that said this attribute was changed on policy change. – Jim B Dec 6 '11 at 13:26
up vote 6 down vote accepted

That checkbox doesn't modify the userAccountControl attribute (on the 2008 DC that I checked on); instead, it adds Deny ACEs against the Change Password right for SELF and Everyone.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.