The "User Cannot change the password" flag for Active Directory Account creation in RSA Identity Governance and Lifecycle does not stop the user from changing their password
3 years ago
Originally Published: 2017-07-26
Article Number
000045559
Applies To
RSA Product Set: RSA Identity Governance and Lifecycle 
Issue
Creating an AD account with option User cannot change the password (Property flag PASSWD_CANT_CHANGE in userAccountControl) in Active Directory via an AFX connector does not prevent the user from being able to change their password.
 
Cause
As described in the Microsoft article below, it's not an attribute, need to grant or deny it on an object. You can set property “PASSWD_CANT_CHANGE” programmatically only. The following link describes how to set the property programmatically. Modifying User Cannot Change Password (LDAP Provider):

https://msdn.microsoft.com/en-us/library/aa746398.aspx?f=255&MSPPError=-2147217396
Resolution
The easiest way to achieve this is by adding a provisioning node to the workflow that will call a PowerShell script. The commands to use are Get-ADUser and Set-ADUser. 
To do it in one command, the syntax would be as follows: 

Get-ADUser -Identity "<distinguishedName>" | Set-ADUser -CannotChangePassword $True

Related Articles

Trending Articles

Don't see what you're looking for?