Active Directory: mass change the option: The user cannot change the password

You want to increase the security level of your Active Directory environment, but historically the option: User cannot change password was enabled.

The script below allows you to modify this option in bulk on your entire directory or just one UO.

# Get user whith CannotChangePassword true / Edit SearchBase
$users = Get-ADUser -Filter * -Properties CannotChangePassword -SearchBase "OU=OUNAME,DC=domain,DC=lan" | where { $_.CannotChangePassword -eq "true" }

# Browse Users and change to false CannotChangePassword
foreach( $user in $users){
 Set-ADUser $user -CannotChangePassword $False
}