Re: How to uncheck Password cannot change Flag in ActiveDirectory

Srihari wrote:

> I am working with Active Directory in C#. I want to reset the password
> and set the User must change the password at next logon. I did it.
> It working fine.
>
> But "Password Cannot change" is set when user is created,
> User must change the password at next logon is not working.
>
> So i want to uncheck the flag ""Password Cannot change". How to do it?
>
> Plaese tell me if anybody knows
>

I don't code in C#, but you need to modify the appropriate bit of the
userAccountControl attribute. You XOR the current value with the bit mask
ADS_UF_PASSWD_CANT_CHANGE to toggle the bit off. In VBScript:
===========
' Bit mask for "Password cannot change"
Const ADS_UF_PASSWD_CANT_CHANGE = &H40

' Bind to user object.
Set objUser = GetObject("LDAP://cn=Jim Smith,ou=Sales,dc=MyDomain,dc=com")

' Retrieve value of userAccountControl attribute.
lngFlag = objUser.userAccountControl

' Check if "Password cannot change" bit is set.
If (lngFlag AND ADS_UF_PASSWD_CANT_CHANGE) <> 0 Then
' Toggle the bit to turn it off.
lngFlag = lngFlag XOR ADS_UF_PASSWD_CANT_CHANGE
' Save changes.
objUser.SetInfo
End If
============
You AND the value of userAccountControl with the bit mask to test if it is
set. Any non-zero result means the bit is set. Zero means the bit is not
set. You OR the value of userAccountControl with the bit mask to set the
bit. You XOR userAccountControl with the bit mask to toggle the bit, which
is the only way to turn it off.

Note, there is also a bit of userAccountControl for "Don't expire password".
The bit mask is &H10000. Also, you can remove permissions for the user to
change their password. The code to restore these permissions is more
complex.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

As you have discovered, the ADS_UF_PASSWD_CANT_CHANGE bit of the
userAccountControl attribute is not functional. It works with local accounts
and NT domains (using the WinNT provider), but not in AD. Instead, you must
deal with the nTSecurityDescriptor of the user object. You add an ACE to the
DACL to deny permission to change the password, or remove this ACE to allow
the user to change their password. I have an example program to grant
permission for a user to change their password linked here:

http://www.rlmueller.net/Can%20Change%20PW.htm

and a similar program to deny permission linked here:

http://www.rlmueller.net/Cannot%20Change%20PW.htm

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--

"carbooter" <> wrote in message
news:...
>
> Only 2 years later -
> I also find the userAccountControl is 512 so &40 is not set even when
> 'user cannot change password' is set.
> I came across
> 'http://www.activeexperts.com/activmonitor/windowsmanagement/adminscripts/usersgroups/users/#DisableUserCannotChPwd.htm
> which gives a vbscript which seems to work for one user. I'll try to
> adapt it for multiple users.
>
>
> --
> carbooter
> ------------------------------------------------------------------------
> carbooter's Profile: http://forums.techarena.in/members/157163.htm
> View this thread: http://forums.techarena.in/active-directory/776795.htm
>
> http://forums.techarena.in
>