AD: user cannot change password

[tvbruwae]

Hi

I am working on a script to replicate account settings between two AD domains. One topic is the parameter "user cannot change password". The "problem" with enabling this setting is that I have two pieces of code that seem to do it:

Const ADS_UF_PASSWD_CANT_CHANGE = &H0040
Set objUser = GetObject("WinNT://mydomain.com/UserID")
objPasswordNoChangeFlag = objUser.UserFlags OR ADS_UF_PASSWD_CANT_CHANGE
objUser.Put "userFlags", objPasswordNoChangeFlag 
objUser.SetInfo

or:

Set objUser = GetObject("WinNT://mydomain.com/UserID")
Set objSD = objUser.Get("ntSecurityDescriptor")
Set objDACL = objSD.DiscretionaryAcl
arrTrustees = array("nt authority\self", "EVERYONE")
For Each strTrustee in arrTrustees
	Set objACE = CreateObject("AccessControlEntry")
	objACE.Trustee = strTrustee
	objACE.AceFlags = 0
	objACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT
	objACE.Flags = ADS_ACEFLAG_OBJECT_TYPE_PRESENT
	objACE.ObjectType = CHANGE_PASSWORD_GUID
	objACE.AccessMask = ADS_RIGHT_DS_CONTROL_ACCESS
	objDACL.AddAce objACE
Next
objSD.DiscretionaryAcl = objDACL
objUser.Put "nTSecurityDescriptor", objSD
objUser.SetInfo

Since there is so much difference between those 2 code samples I was wondering if I can just pick either one to do what I need or if I should pay attention to some conditions? Can anyone help me out with this?

Thanks!

 

[tsuji]

The ntSecurityDescriptor is available via LDAP: provider and is not available to WinNT: as used in the first script. Hence, the 2nd script would essentially be a non-stater. You could stick to the first approach.

 

[tvbruwae]

OK, so there is no difference in what the code actually does then.. Thanks for the answer!

 

[tsuji]

The 2nd script can be useful if your user is referenced via LDAP: provider - that's what I meant non-sta[red]r[/red]ter. Furthermore, you may perhaps not be interested at this moment, the 2nd script, though looks impressively doing "more" and grand, is in fact has a bit more hidden limitations as apply to the real. The references to nt authority\self and everyone accounts are limited to the system not being localized to any other international languages. Otherwise, you have to add many more twists to it to make it work. The first script suffers no such limitation, though, look a bit old-school in its appeal.