The ability of a user to change their own password is a permission that can be granted or denied. For more information about programmatically reading and modifying this permission using the WinNT provider, see:
The userFlags property of the user object is only available when using the WinNT provider.
It is also possible to read and modify this permission using the LDAP provider. For more information, see User Cannot Change Password (LDAP Provider).