The "User Cannot change the password" flag for Active Directory Account creation in RSA Identity Governance and Lifecycle does not stop the user from changing their password

3 years ago

Originally Published: 2017-07-26

Article Number

000045559

Applies To

RSA Product Set: RSA Identity Governance and Lifecycle

Issue

Creating an AD account with option User cannot change the password (Property flag PASSWD_CANT_CHANGE in userAccountControl) in Active Directory via an AFX connector does not prevent the user from being able to change their password.

Cause

As described in the Microsoft article below, it's not an attribute, need to grant or deny it on an object. You can set property “PASSWD_CANT_CHANGE” programmatically only. The following link describes how to set the property programmatically. Modifying User Cannot Change Password (LDAP Provider):

https://msdn.microsoft.com/en-us/library/aa746398.aspx?f=255&MSPPError=-2147217396

Resolution

The easiest way to achieve this is by adding a provisioning node to the workflow that will call a PowerShell script. The commands to use are Get-ADUser and Set-ADUser.
To do it in one command, the syntax would be as follows:

Get-ADUser -Identity "<distinguishedName>" | Set-ADUser -CannotChangePassword $True

Don't see what you're looking for?

Related Articles

Trending Articles