If you wish to prevent users from changing their password on demand, you can implement the Disable Change Password Group Policy at User Configuration\Administrative Templates\System\Logon/Logoff.
This policy grays the Change Password button on the Windows Security dialog box, that appears when you press CTRL+ALT+DEL.
This policy still enables the user to change their password in response to a system prompt, as when their password is about to expire or an Administrator checks User must change password at next logon.
If Not Configured, you can implement this policy by using Regedt32 to navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
On the Edit menu, Add Value name DisableChangePassword, as a REG_DWORD data type. Set the data value to 1.
