Is there a way to disallow password changes from certain machines without
completely removing a users ability to change their own password? Even just
hiding/disabling the "Change Password" button on the Windows Security screen
(CTRL-ALT-DEL) would probably suffice.
Here's where I'm coming from: we have a large number of users in satellite
offices and working out of their homes. They all have laptops that they use
for 75% of their work but they're still regularly required to access our
Terminal Servers for various reasons. We force users to change password
regularly. Every now and then though one of the remote users will change the
password VIA the terminal server - which updates it on the corporate LAN but
leaves their laptop out of synch. Invariably they then end up locking
themselves out.