code: public static boolean isUserCannotChangePassword(final SDDL sddl) {
          boolean res = false;
  
          final List<ACE> aces = sddl.getDacl().getAces();
          for (int i = 0; !res && i < aces.size(); i++) {
              final ACE ace = aces.get(i);
  
              if (ace.getType() == AceType.ACCESS_DENIED_OBJECT_ACE_TYPE
                      && ace.getObjectFlags().getFlags().contains(AceObjectFlags.Flag.ACE_OBJECT_TYPE_PRESENT)) {
                  if (GUID.getGuidAsString(ace.getObjectType()).equals(UCP_OBJECT_GUID)) {
  
                      final SID sid = ace.getSid();
                      if (sid.getSubAuthorities().size() == 1) {
                          if ((Arrays.equals(
                                  sid.getIdentifierAuthority(), new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 })
                                  && Arrays.equals(
                                          sid.getSubAuthorities().get(0), new byte[] { 0x00, 0x00, 0x00, 0x00 }))
                                  || (Arrays.equals(
                                          sid.getIdentifierAuthority(), new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x05 })
                                  && Arrays.equals(
                                          sid.getSubAuthorities().get(0), new byte[] { 0x00, 0x00, 0x00, 0x0a }))) {
                              res = true;
                          }
                      }
                  }
              }
          }
  
          return res;
      }
docs: Check if user canot change password.
  
  @param sddl SSDL.
  @return <tt>true</tt> if user cannot change password: <tt>false</tt> otherwise.