We are setting up a Windows Server 2008 R2 domain. When we create a user within AD, the checkbox labeled "User cannot change password" in the Account tab is unchecked for every user we create. Can this be changed so for each user we create this is checked by default?
To my knowledge this can't be set for a default for that tool.
However, you can set Group Policy so that users are disallowed from password changes at that level.
User Config -> Policies -> Administrative Templates -> System -> Ctrl+Alt+Del Options
There is a "Remove Change Password". There are some others scattered about, so look for them.
We're doing something similar. The reason for this is that we have a non-Microsoft password change procedure we've built, thanks to the need to synchronize password changes to multiple systems. If users change their AD password through native tools, their password won't get synced to other systems and they'll call the helpdesk when they can't get in. This also allowed us to put robust password quality rules in place before our underlying systems all supported it.
You can do this via code. Take a look at the following MSDN article about half way down the page
"The following C# example shows a function that sets an ACE to deny a user the right to change their password. This example uses the managed ACL functionality available in .NET Framework 2.0."