Can't change/update/synch password for LDAP user

Hi. I've got LDAP working fine except for the ability to change a user's password. I have a mixed environment where admins create some users but the bulk already have accounts in active directory. I want the Active Directory users to be able to change their passwords and have that data write to AD. I have attained the desired results in D6 (though I recall I had to put a patch in place to accommodate AD).

When a user authenticates via LDAP, and goes to edit his account, he gets the messsage, "The password cannot be changed using this website" under Current Password, which is grayed out as are the new password fields. Likewise, an admin cannot change the password for a user who has authenticated via LDAP.

In User settings I have:

• How to resolve LDAP conflicts with manually created Drupal accounts.
• Associate manually created Drupal accounts with related LDAP Account if one exists.
• Drupal Account Provisioning Events
• Create or Synch to Drupal user on successful authentication with LDAP credentials. (Requires LDAP Authentication module).
• Create or Synch to Drupal user anytime a Drupal user account is created or updated. Requires a server with binding method of "Service Account Bind" or "Anonymous Bind".
• Existing Drupal User Account Conflict
• Associate Drupal account with the LDAP entry. This option is useful for creating accounts and assigning roles before an LDAP user authenticates.
• Application of Drupal Account settings to LDAP Authenticated Users
• Account creation settings at /admin/config/people/accounts/settings do not affect "LDAP Associated" Drupal accounts.
• Action to perform on Drupal account that no longer have a corresponding LDAP entry
• Perform no action, but email list of orphaned accounts. (All the other options will send email summaries also.)

In Provisioning from LDAP to Drupal Mappings, I notice it doesn't provision the password and I can't see any options for doing so.

I've read through all the other password help requests here and I don't see this specific issue. Does this ring a bell for anyone?

Thanks.