How to disable "Password Never Expires" option from Active Directory

i really doubt you can do this.  if anything this would be a change inside the schema

What always works for me is a deadblow hammer and threaten anyone that does it.  Or you can suspend their AD priviledges if they repeatedly do it.  I'm not sure this can be done to be honest.

> How can I disable the option to even CHECK that box completely from the AD interface?  

You could potentially deny write access to userAccountControl. Unfortunately it isn't possible to split the "Password Never Expires" option out of that set. The set also includes account disable, trusted for delegation, and everything else in the same box in the GUI.

The rather hideous alternative is to build your own GUI that doesn't include access to that option. It wouldn't stop modification of that field through ADSIEdit or by script though.

The best you can do with this normally is strongly and frequent auditing. Both of who is making changes, and whether or not that attribute has been set.

Chris

Thats by Design, so disabing that option is not recommended by Microsoft.
Alternate option is executing the script on periodic basis to identifying the accounts that are configured with "Passwords Never Expire" .

For reference refer to Below link.

http://www.wisesoft.co.uk/scripts/vbscript_enable-disable_password_never_expires.aspx

Password never expires overrides the Password policy for the domain. It is used to prevent the admin passwords from being changed. Let me tell you why.

Let's say the admin password is logged on in different locations. If the password is changed when logged on to multiple locations, it locks the password and you can get locked out of the domain. Furthermore, some applications use Domain admin. Let's say you have a scanner that requires domain admin access, (like an asset inventory software). For that to work it may require Domain admin passwords. If you change your domain admin password, you have to change it on ALL of those types of applications.

You should be able to deselect "password never expires". When people say "don't do it" there is a reason.

To overcome your problem, deny admin rights as administrators. That is the ONLY way to prevent them from changing their habbits of "password never expires" that I know of. Of course, the hammer method will work too, right zack4x4?

There's not going to be a way to enforce this using native Active Directory tools. You will need to implement a user provisioning tool that enforces this business rule, and only grant permissions to create user accounts within that tool.  Even then, you will still have DAs with permissions directly within the directory, so you will need to perform ongoing auditing to ensure that compliance is being maintained.

AD is a data repository, it doesn't enforce business rules.