Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When I set the flag "User cannot change password" in the user settings of my active directory I would expect the value userAccountControl to change its value. But it doesn't. I start with that:

userAccountControl = 0x200 => NORMAL_ACCOUNT

If I set the flag "User cannot change password" I would expect this:

userAccountControl = 0x240 => NORMAL_ACCOUNT and PASSWD_CANT_CHANGE

But it is still the old value.
If I set the flag "Password never expires" then userAccountControl changes. But why isn't that working with "User cannot change password"?

share|improve this question
1  
What makes you think that the useraccountcontrol attribute reflects password permissions? –  Jim B Dec 5 '11 at 17:34
    
@JimB: this site indicates that: msdn.microsoft.com/en-us/library/windows/desktop/… –  juergen d Dec 6 '11 at 11:02
1  
ahh, ok you must have missed the line on update frequency that said this attribute was changed on policy change. –  Jim B Dec 6 '11 at 13:26

1 Answer 1

up vote 6 down vote accepted

That checkbox doesn't modify the userAccountControl attribute (on the 2008 DC that I checked on); instead, it adds Deny ACEs against the Change Password right for SELF and Everyone.

changepwd

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.