User migrated with the User Cannot Change Password property enabled have different permission in D (NETIQKB14906)

fact
Domain Migration Administrator 6.x

fact
Domain Migration Administrator 7.x

symptom
Users migrated with the "User Cannot Change Password" property enabled have different permission in DSA than users migrated with the property off.

symptom
Domain Migration Administrator created users do not have the same permissions as Active Directory Users and Computers created accounts. When the account is migrated without the option 'User cannot change password' enabled, the permissions match between the ADUC create account and the DMA created account

fix

 If you want to secure it using permissions on the user object, you can use a script to deselect (using NetAPIs) and reselect that flag (using ADSI).

note
This is a result of the method used by Domain Migration Administrator to set the User cannot change password flag.

Formerly known as NETIQKB14906