Domain Migration Administrator 6.x
Domain Migration Administrator 7.x
Users migrated with the "User Cannot Change Password" property enabled have different permission in DSA than users migrated with the property off.
Domain Migration Administrator created users do not have the same permissions as Active Directory Users and Computers created accounts. When the account is migrated without the option 'User cannot change password' enabled, the permissions match between the ADUC create account and the DMA created account
If you want to secure it using permissions on the user object, you can use a script to deselect (using NetAPIs) and reselect that flag (using ADSI).
This is a result of the method used by Domain Migration Administrator to set the User cannot change password flag.