Table of Content > Extended Handling of AD Objects > AD Permissions : (De)Activate the option "User cannot change password"

AD Permissions :
(De)Activate the option "User cannot change password"

When you develop scripts in Active Directory environments, sometimes you need to change the permissions of AD objects, even if at first glance it does not look like that. An example of this is to set the option "User can not change password" in the account properties of an Active Directory user account:



This is not a property which is set to TRUE or FALSE. The check mark visible here is managed in a very classical manner through AD permissions:

• User cannot change password is activated=> Permission "Everyone: Change password" is denied.
  BILD
  
  
• User cannot change password is deactivated =>Permission"Everyone + Self : Change password" is granted.
  BILD
  

Set option "User cannot change password" in your own script

On the command line interface, you could simply perform this command with the system utility DSACLS.EXE on the domain controller (depending on whether you want to activate the option or not):

dsacls "LDAP path of user account" /D "EVERYONE":CA;"Change Password"       <- denies the permission to change password


dsacls "LDAP path of user account" /G "SELF":CA;"Change Password"           <- grants the permission to change password
dsacls "LDAP path of user account" /G "EVERYONE":CA;"Change Password"

The LDAP path of a user looks - for example - like this: cn=Philipp,ou=Dev,dc=ldapexplorer,dc=com.


Attention: You can set the option "User cannot change password" once, but with DSACLS, the existing default grant permission is NOT deleted. In this case, two opposite entries in the ACL of the user exist (of which the "Deny" wins):

So you cannot replace single ACL entries with DSACLS, you can only replace the entire access list. But this is not desirable for our case.
Man kann mit DSACLS eben nicht einzelne ACL-Einträge ersetzen, sondern nur die gesamte Rechte-Liste, was für unseren Fall jedoch nicht erwünscht ist. So to actually turn the option on and off, we need a separate script with the following approach:

1. Reads the list of relevant user rights object. Takes all entries EXCEPT those in which "Self" and "EVERYONE" are granted or denied the "Change password" permission.
2. Builts an appropriate new ACL from the entries which were found.
3. Adds to this ACL an entry with the "Self" and "EVERYONE" permission to change the password (granted or denied as required).
4. Writes the new ACL back to the directory.

There is an SelfADSI tuorial article which explains in detailed the internal structure of ACLs and how they can be manipulated: AD Security Descriptors.

Therefor we show "only" the pure script here that can set the option "User cannot change password" for a specific user:

Download Script

Attention: In environments with other OS languages than english the variables WKSID_SELF and WKSID_EVERYONE have to be adjusted accordingly. In german DC environments for example, you have to use "NT-AUTORITÄT\SELBST" and "JEDER" here!

Here comes the version of the script, which in reversion to previously deactivates the option "User cannot change password":

Download Script

Attention: In environments with other OS languages than english the variables WKSID_SELF and WKSID_EVERYONE have to be adjusted accordingly. In german DC environments for example, you have to use "NT-AUTORITÄT\SELBST" and "JEDER" here!