HOW TO: Block access to password options (4320164)

This article explains how to block the ability to set Password Never Expires, User Cannot Change Password and User Must Change Password at Next Logon.

NOTE: Because the Password Options are displayed as one custom element in the Active Roles Web Interface, the below Access Template will not affect access to these options. Instead, it will be necessary to use a custom Active Roles Policy script module in order to set the desired value.

1. Open ActiveRoles MMC Console
2. Create a new Access Template
3. Click Add
4. Select Only the following classes
5. Select Users
6. Select Object Property Access
7. Click Deny Permission and Write Properties
8. Click Next
9. Choose the following properties
10. Select Show all possible properties
11. Choose Password Never Expires, User Cannot Change Password and User Must Change Password at Next Logon
12. Save the Access Template
13. Apply (link) the new Access Template to the appropriate users/groups and the target location (i.e Active Directory)
14. If logged into the Web Interface, log out and back in to test and confirm the options are grayed out

1. Log onto the Helpdesk site as an ARS Admin
2. Navigate to the Reset Password page of any user
3. Click click here to customize this form
4. Select Account Options and click on Delete on the menu above it
5. Click Save
6. Either click Reload above or hover over Customization on the top right menu and select Reload
7. Go back to the user properties and Reset Password and the options will be gone. You will be left with the Password fields and Account Unlock option (grayed out by default if not currently locked)