I have a question about active directory permission to change password. Is it possible to revoke permission to change password for users from specific OU?

How can I accomplish this task? I know it can be done for specific group of users but is it possible for users in specific OU?


Thanks for all your answers. They were really helpful. Unfortunately I cannot upvote these reponses due to my low reputation ;)

95% percent of users are in the OU I'm writing about. I'm thinking about removing change password permission from Everyone group and creating group for users that would be able to change their passwords. The issue is that users from this OU are in another application and they should change their password using this app, not in AD. Users that are not in this OU are only in AD, so they can change their passwords in AD.

Do you think that would be a good solution or there will problems with it?

Thanks for help.


John Rennie and Sam Cogan's answers (as John so aptly states) are "hacks" insofar as they attempt to disable the user-interface to change passwords but don't actually take away the ability for the user to change their password.

I think you're looking for a change to the permissions Active Directory sets by default on the OU where the user accounts are located. I'm going to caution you against that. Since Microsoft already provides this functionality through an attribute on the user account objects it's really better to use that already-provided attribute than to change the AD permissions. It's likely that you could find a permission that works, and it's also just as likely that the OS isn't going to display helpful messages.

You really should just all the affected users using Active Directory Users and Computers and modifying the properties of the user accounts en masse. Dart's answer is functionally the same as selecting all the user accounts and setting their "User cannot change password" graphically. If you like the command-line better, do that.

There is functionality to do this with an "Extended Right" using Active Directory permissions in Windows 2003. I'm not finding good documentation on the feature. Here's some background on the "extended rights" associated with changing passwords, the first relating to Active Directory "Application Mode" (or whatever Microsoft is calling it this week):

I attempted to verify Massimo's answer by placing a "SELF - Deny - User Objects - Extended Right: Change Password" permission on an OU in my test W2K3 Active Directory (Windows 2003 Domain Functional Level) and found that the user objects at or below that OU were still able to change their passwords using the GUI password change functionality. Looking at each user object, I could see the inherited "Deny" permission, but Active Directory appeared to ignore it.

Just removing the "SELF - Allow - Change Password" permission on a user object gave the me same functionality as the above test. The user was still permitted to change their password.

I'd say, on that basis, that Massimo's answer doesn't do what you want either.

I found this article from Microsoft and tested it out. When I target the script at an individual user object it behaves as desired and the user is unable to change their password. This isn't much help to you, though, since you want to set this on a per-OU basis.

When I target that script from Microsoft at an OU, however, the behaviour on longer is as expected. (Further, if I modify the ACEs added to the OU to apply to "This object and child objects" instead of "This object only" as is granted by the script the behaviour still is not as expected.)

I'm really beating my head into a wall on this one. This looks like a quirk of Active Directory behaviour that isn't well documented. I've been through the "Active Directory Domain Services" and Active Directory schema documentation and I'm not finding documentation to describe this behaviour.

  • could you check update for my question? do you think that it would be a good solution? – empi Jul 13 '09 at 13:07
  • @empi: If I could tell you how to do what you describe in your update it would probably work fine. So far I've only been able to come up with a user-per-user method of disabling "Change password" functionality. I haven't figured out any way to do it for an OU or the entire domain. – Evan Anderson Jul 13 '09 at 13:09
  • @Evan Anderson: removing change password permission from Everyone group won't prevent users from changing their password? I thought that if I remove change password permission from Everyone group then nobody would be able to change their password. Then I will create new group, add to it permission to change password and the I will manually add users to this (of course only users that will be able to change their password). Do you think that it won't work? – empi Jul 13 '09 at 13:14
  • 1
    The "Everyone - Change Password" permission isn't explicity granted on the domain itself such that you can remove it. I've put an "Everyone - Deny Change Password" and "SELF - Deny Change Password" at the root of my test domain, verified that it inherits to my test user object, and STILL the user can change their password. The only way I've been able to deny the permission has bene to put the "Deny" ACEs directly on the user object itself. – Evan Anderson Jul 13 '09 at 13:26

See http://support.microsoft.com/kb/324744

However note that this is a bit of a hack. It doesn't stop users changing their passwords, it just removes the option to do so from the ctrl-alt-del dialog. Users could still use a command line password changer.



Yes, you can do so through group policy. Open group policy editor for the OU you want to restrict (right click OU, properties, group policy tab). Create a new policy, or edit an existing one and go to:

User Configuration -> Administrative Templates -> System

In here, select Ctrl+Alt+Del Options, in the right hand pane, enable the 'Remove Change Password' option.

Close group policy editor. To ensure its applied immediately open a command prompt and run

gpupdate /target:user /force
  • Strictly speaking that doesn't stop users changing their password, it just removes the option from the ctrl-alt-del dialog. I can't find any group policy setting that does the same as ticking the "User cannot change password" box in the user properties. – John Rennie Jul 13 '09 at 10:33

Use dsmod. For a guide to do this for an OU see http://windowsitpro.com/article/articleid/80359/jsi-tip-7785-how-do-i-modify-active-directory-attributes-for-all-members-of-an-organizational-unit-in-my-domain.html

  • Unfortunately, that's not an option. Since new users may be added to this OU and they still shouldn't be able to change their password. This must be solved on OU level and it cannot be per-user solution. However, thanks for help. – empi Jul 13 '09 at 11:02
  • I think that it's not possible to specify that at the OU level without doing any customisation, based on Evan's post below. It's possible a password hook might do the trick for you instead, but you'd need to customise it for your own needs. A generic OSS password hook is available at sourceforge.net/projects/passwdhk – dart Jul 13 '09 at 11:33

You can remove the permission to do this for a specific user by removing (or explicitly denying) "change password" from the user rights assigned to "SELF".

You have to manually edit the ACL on the user object itself; you can access it by enabling advanced features in the Active Directory Users and Computers console (View -> Advanced Features), and then opening the user's properties and selecting "Security".

  • Have a look at the tests I ran in my answer. I'm not getting what you're recommending to actually work in tests on a live AD. – Evan Anderson Jul 13 '09 at 11:19
  • Thanks for the extensive testing you're doing, I'd always thought that ACE should have worked that way but never actually tested it. Quite strange behaviour, anyway... why is even that ACE there, if it's actually unused?!? – Massimo Jul 13 '09 at 12:06
  • You would think that what you suggest would work, eh? So would I. See the newest edit to my answer. You CAN set an "Everyone - Deny Change Password" and "SELF - Deny Change Password" on an object-for-object basis and it works, but that's not what the poster wants (and isn't any better than just setting the value in the userAccountControl enumeration.) – Evan Anderson Jul 13 '09 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.