r4651: Add "refuse machine password change" policy field. This update will just