back in the day, I created an UDF that beautifully took care of "user cannot change password" flag in my AD.

well, not any longer. I tried it as it is, as per MS documentation here:

and with removeAce() like here:

but still no go, it just keeps failing. Anyone have any working code or insight what I need to change to make it fly?

First year I ran the code, I ran it as domain admin. But last year I could swear it worked fine as account operator.
This year, no matter what I do, I keep ending with error 9 on setinfo line. I do not get it. After fighting with it for days, I would welcome any help I can get to get it working again. Today after clicking manually on few hundred accounts to untick that option, I can tell you my wrist hurts.

download KiXnet