diff --git a/conf/config.inc.php b/conf/config.inc.php
index db1a7ccca..d09f29654 100644
--- a/conf/config.inc.php
+++ b/conf/config.inc.php
@@ -58,6 +58,8 @@
 $ad_options['force_pwd_change'] = false;
 # Allow user with expired password to change password
 $ad_options['change_expired_password'] = false;
+# Force who_change_password to be 'user', useful in AD environments
+$ad_force_low_privileged_change = false;
 
 # Samba mode
 # true: update sambaNTpassword and sambaPwdLastSet attributes too
diff --git a/htdocs/change.php b/htdocs/change.php
index 620fa3857..6377d0360 100644
--- a/htdocs/change.php
+++ b/htdocs/change.php
@@ -172,6 +172,10 @@
                     }
                 }
 
+                if ($ad_force_low_privileged_change){
+                    $who_change_password = "user";
+                }
+
             }
         }
     }