Make Auth Broker authoritative for managed passwords

scripts/Deploy-AuthBroker.ps1

@@ -201,6 +201,19 @@ if ($RemoteDesktopGroupDn) {
     }
 }
 
+$managedUsersPasswordChangeCorrected = 0
+if ($PSCmdlet.ShouldProcess($usersOuDn, 'Deny direct password changes for every managed SGU user')) {
+    $managedUsers = @(Get-ADUser -Filter * -SearchBase $usersOuDn -SearchScope Subtree `
+        -Properties CannotChangePassword -Server $LdapHost -ErrorAction Stop)
+    foreach ($managedUser in $managedUsers) {
+        if (-not $managedUser.CannotChangePassword) {
+            Set-ADAccountControl -Identity $managedUser.DistinguishedName `
+                -CannotChangePassword $true -Server $LdapHost -Confirm:$false
+            $managedUsersPasswordChangeCorrected++
+        }
+    }
+}
+
 foreach ($file in @('SGU.AuthBroker.exe', 'SGU.AuthBroker.dll', 'appsettings.json')) {
     if (-not (Test-Path -LiteralPath (Join-Path $PublishPath $file))) {
         throw "PublishPath is missing $file."
@@ -356,4 +369,5 @@ if ($PSCmdlet.ShouldProcess($installPath, 'Install the SGU Authentication Broker
 }
 
 Get-Service -Name $serviceName | Select-Object Name, Status, StartType,
-    @{ Name = 'EventLog'; Expression = { $brokerEventLogName } }
+    @{ Name = 'EventLog'; Expression = { $brokerEventLogName } },
+    @{ Name = 'ExistingUsersPasswordChangeDenied'; Expression = { $managedUsersPasswordChangeCorrected } }