File Share Encryption

I'm using US 3.2 in a Windows 2008 Domain.

All I am using is WDE - nothing else

I am forcing SSO. User's use their AD credentials for the Passphrase and Windows login. This works perfect.

User's are changing their Passphrase, but only their AD creds get past BootGuard, not their 'new' Passphrase. User's are asking me Why!  They don't want to have to use the AD password to get past BootGuard. Go figure!

How do I remove 'Change Passphrase' from the options box without removing the option box itself?

I do not want a user's AD credentials and Passphrase to be different.

If I can't remove 'Change Passphrase', how to I stop user's from changing their Passphrase?

Presumably you're using a Universal Server? Have you tried removing rights to "Allow User Management" in the applied policy? (Policy > PGP Desktop, Desktop... > Disk Encryption tab)

Not sure if that will stop users changing their own passphrases, but worth a shot.