I have a question about disabling the ability for a user to change
their password by using alter login <login name> with password = <new
password>. We have a different process in place, with audit trails,
that a SQL authenticated user can change their password. So how can
we prevent a user from being able to use the Alter Login option to
change their password?

Thanks much,
Joe

JoeyD (joeydba (AT) gmail (DOT) com) writes:
I can see two possibilities. One is to set up a DDL trigger for ALTER_LOGIN
and then checks if the WITH PASSWORD clause is present.

The other is to set the password policy in Windows on the SQL Server machine
to not permit users to change their passwords.


--
Erland Sommarskog, SQL Server MVP, esquel (AT) sommarskog (DOT) se

Links for SQL Server Books Online:
SQL 2008: http://msdn.microsoft.com/en-us/sqlserver/cc514207.aspx
SQL 2005: http://msdn.microsoft.com/en-us/sqlserver/bb895970.aspx

Thank you for the suggestions. I had given some thought to the DDL Trigger but wasn't sure I wanted to go down that road.