Hide password changes for managed SGU users

tests/AuthBrokerPasswordAuthority.Tests.ps1

@@ -1,8 +1,10 @@
 $repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
 $synchronizerPath = Join-Path $repositoryRoot 'src\SGU.AuthBroker\Services\ActiveDirectorySynchronizer.cs'
 $deployPath = Join-Path $repositoryRoot 'scripts\Deploy-AuthBroker.ps1'
+$userPolicyPath = Join-Path $repositoryRoot 'scripts\Set-SguDomainUserPolicies.ps1'
 $synchronizer = Get-Content -LiteralPath $synchronizerPath -Raw
 $deploy = Get-Content -LiteralPath $deployPath -Raw
+$userPolicy = Get-Content -LiteralPath $userPolicyPath -Raw
 
 Describe 'SGU Auth Broker password authority' {
     It 'denies the Change Password extended right to SELF and Everyone before SetPassword' {
@@ -18,4 +20,9 @@ Describe 'SGU Auth Broker password authority' {
         $deploy | Should Match 'Get-ADUser.*-SearchBase \$usersOuDn.*-SearchScope Subtree'
         $deploy | Should Match '(?s)Set-ADAccountControl.*-CannotChangePassword \$true'
     }
+
+    It 'removes Change Password from the Windows security screen for managed users' {
+        $userPolicy | Should Match "disableChangePasswordValueName = 'DisableChangePassword'"
+        $userPolicy | Should Match '(?s)-ValueName \$disableChangePasswordValueName.*-Type DWord.*-Value 1'
+    }
 }