When an attempt to change a user's password is made, Windows 2000 may issue the following error message:
The password cannot be changed at this time.
If the GPO for the users OU has the Minimum Password Age as Not Defined, this error will be generated.
You must configure the Minimum Password Age policy as 0 days, instead of Not Defined:
01. Open Active Directory Users and Computers.
02. Right-click the domain name and press Properties.
03. If users are configured to a specific OU, select the OU.
04. Select the Group Policy tab.
05. Select the Default Domain Policy and press Edit.
06. Navigate through Computer Configuration / Windows Settings / Security Settings / Account Policies / Password Policy.
07. Right-click Minimum Password Age and press Security.
08. Check the Define this policy setting box.
09. Set the counter to 0 days.
10. Press OK.
11. Exit the Group Policy Editor.
12. Quit Active Directory Users and Computers.
13. On a domain controller, open a CMD prompt and type secedit /refreshpolicy machine_policy /enforce
NOTE: You may have to restart the domain controller for this policy to be updated.