We are setting up a Windows Server 2008 R2 domain. When we create a user within AD, the checkbox labeled "User cannot change password" in the Account tab is unchecked for every user we create. Can this be changed so for each user we create this is checked by default?

  • 3
    Why do you not want users to be able to change their password? That goes against pretty much every security best practice. – Zypher May 14 '10 at 17:11

To my knowledge this can't be set for a default for that tool.

However, you can set Group Policy so that users are disallowed from password changes at that level.

User Config -> Policies -> Administrative Templates -> System -> Ctrl+Alt+Del Options

There is a "Remove Change Password". There are some others scattered about, so look for them.

We're doing something similar. The reason for this is that we have a non-Microsoft password change procedure we've built, thanks to the need to synchronize password changes to multiple systems. If users change their AD password through native tools, their password won't get synced to other systems and they'll call the helpdesk when they can't get in. This also allowed us to put robust password quality rules in place before our underlying systems all supported it.

| improve this answer | |

Perhaps another approach would be creating a user template account with "User cannot Change Password" enabled, and copying it for new users.

| improve this answer | |

You can do this via code. Take a look at the following MSDN article about half way down the page

"The following C# example shows a function that sets an ACE to deny a user the right to change their password. This example uses the managed ACL functionality available in .NET Framework 2.0."


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy