So here is my working version (to prevent the need to carry it around with me 'till monday )

Code:

function ADS_PWChangeRight($usr, $domain, $Right)
    ; 64 is ADS_UF_PASSWORD_CANT_CHANGE (&40)
    dim $objUsr, $_, $UserFlags
    $objUsr = getobject("WinNT://" + $domain + "/" + $usr + ",user")
    if not @error
        $UserFlags = $objUsr.Get("UserFlags")
        if not $Right
            $UserFlags = $UserFlags | 64
        else
            if not ($UserFlags & 64)
                $ADS_PWChangeRight = 0
                exit 0
            endif
            $UserFlags = $UserFlags ^ 64
        endif
        $objUsr.Put("UserFlags", $UserFlags)
        $objUsr.SetInfo
        $ADS_PWChangeRight = @error
    else
        $ADS_PWChangeRight = @error
    endif
endfunction


(no need to write the flags back when there is actually no change, no?)
_________________________