How can I prevent an Assistant Admin from checking the Password never expires flag when creating a u (NETIQKB4311)

goal
How can I prevent an Assistant Admin from checking the Password never expires flag when creating a user account?

fact
Directory and Resource Administrator 6.x

fix

In order to prevent an Assistant Admin from creating a user account with the Password never expires flag, there are two options available:

• Modify the ActiveView configuration by granting the Assistant Admin Limited Powers - Create a user account power instead of the All properties - Create a user account power. If the Limited Powers - Create a user account power is granted, the Assistant Admin will not be presented with the option to check the Password never expires flag. 

OR

• A pre-task trigger can also be created in Directory and Resource Administrator which checks if the Password never expires flag is checked and returns a customized error message if an Assistant Admin attempts to create a user account with the option checked.

A sample script called PasswordNeverExpires.vbs prevents Assistant Admins from selecting the Password never expires flag when creating or updating a user account.  This script is available on the DRA Knowledge Depot.

• DRA Knowledge Depot (requires username and password)