Password changes with users / groups locked down

[intuneadmins]

We currently have the users and groups locked down on our users Macs via JAMF policy as we want to stop them creating their own accounts or deleting others..

This is however causing issues as they're not able to change their passwords.

Does anyone know of another way do this? We eventually hope to implement JAMF Connect but would like a solution now.

[chadlawson]

My first thought is to have an extension attribute that lists all the users, excluding the active user, root, and system accounts.

Then create a smart group or saved reports that reports on those.

If that would work, I may have something similar already written someplace that I really shouldn't share publicly, but may be able to provide privately.