diff --git a/apps/app_voicemail.c b/apps/app_voicemail.c
index cf03307b323cc26d682de1458183d1aca95ea33d..11188afd994bffab67343c310bb297a0159cae55 100755
--- a/apps/app_voicemail.c
+++ b/apps/app_voicemail.c
@@ -3411,6 +3411,10 @@ static int vm_options(struct ast_channel *chan, struct ast_vm_user *vmu, struct
 			cmd = play_record_review(chan,"vm-rec-name",prefile, maxgreet, fmtc, 0, vmu, &duration);
 			break;
 		case '4':
+			if (vmu->password[0] == '-') {
+				cmd = play_and_wait(chan, "vm-no");
+				break;
+			}
 			newpassword[1] = '\0';
 			newpassword[0] = cmd = play_and_wait(chan,"vm-newpassword");
 			if (cmd < 0)
@@ -3540,6 +3544,7 @@ static int vm_execmain(struct ast_channel *chan, void *data)
 	char *context=NULL;
 	int silentexit = 0;
 	char cid[256]="";
+	char *passptr;
 
 	LOCAL_USER_ADD(u);
 	memset(&vms, 0, sizeof(vms));
@@ -3619,7 +3624,7 @@ static int vm_execmain(struct ast_channel *chan, void *data)
 			adsi_password(chan);
 		if (!skipuser)
 			vmu = find_user(&vmus, context, vms.username);
-		if (vmu && vmu->password[0] == '\0') {
+		if (vmu && (vmu->password[0] == '\0' || (vmu->password[0] == '-' && vmu->password[1] == '\0'))) {
 			/* saved password is blank, so don't bother asking */
 			password[0] = '\0';
 		} else {
@@ -3638,7 +3643,11 @@ static int vm_execmain(struct ast_channel *chan, void *data)
 			strncat(fullusername, vms.username, sizeof(fullusername) - 1);
 			strncpy(vms.username, fullusername, sizeof(vms.username) - 1);
 		}
-		if (vmu && !strcmp(vmu->password, password)) 
+		if (vmu) {
+			passptr = vmu->password;
+			if (passptr[0] == '-') passptr++;
+		}
+		if (vmu && !strcmp(passptr, password))
 			valid++;
 		else {
 			if (option_verbose > 2)
diff --git a/configs/voicemail.conf.sample b/configs/voicemail.conf.sample
index 2620a485b66cc0d0cda2c3218c2eaaf3a8b93e7c..f026e3d821cd17576117028451094cfb2e494f9d 100755
--- a/configs/voicemail.conf.sample
+++ b/configs/voicemail.conf.sample
@@ -90,7 +90,7 @@ maxlogins=3
 ;
 ; Each mailbox is listed in the form <mailbox>=<password>,<name>,<email>,<pager_email>,<options>
 ; if the e-mail is specified, a message will be sent when a message is
-; received, to the given mailbox. If pager is specified, a message will be sent there as well.
+; received, to the given mailbox. If pager is specified, a message will be sent there as well. If the password is prefixed by '-' then it is considered to be unchangable
 ;
 ; Advanced options example is extension 4069
 ; NOTE: All options can be expressed globally in the general section, and overriden in the per-mailbox 
@@ -126,7 +126,7 @@ central24=America/Chicago|'vm-received' q 'digits/at' H 'digits/hundred' M 'hour
 1234 => 4242,Example Mailbox,root@localhost
 ;4200 => 9855,Mark Spencer,markster@linux-support.net,mypager@digium.com,attach=no|serveremail=myaddy@digium.com|tz=central
 ;4300 => 3456,Ben Rigas,ben@american-computer.net
-;4310 => 5432,Sales,sales@marko.net
+;4310 => -5432,Sales,sales@marko.net
 ;4069 => 6522,Matt Brooks,matt@marko.net,,|tz=central|attach=yes|saycid=yes|dialout=fromvm|callback=fromvm|review=yes|operator=yes|envelope=yes
 ;4073 => 1099,Bianca Paige,bianca@biancapaige.com,,delete=1
 ;4110 => 3443,Rob Flynn,rflynn@blueridge.net
diff --git a/contrib/scripts/vmail.cgi b/contrib/scripts/vmail.cgi
index 887f604a2ac08b1970028e342043de6d74fe7d98..e398ec93f87f7f71a338d2db8bafcea6df3583d2 100755
--- a/contrib/scripts/vmail.cgi
+++ b/contrib/scripts/vmail.cgi
@@ -107,7 +107,7 @@ sub check_login()
 			if (/([^\s]+)\s*\=\>?\s*(.*)/) {
 				@fields = split(/\,\s*/, $2);
 #				print "<p>Mailbox is $1\n";
-				if (($mbox eq $1) && ($pass eq $fields[0]) && ($context eq $category)) {
+				if (($mbox eq $1) && (($pass eq $fields[0]) || ("-${pass}" eq $fields[0])) && ($context eq $category)) {
 					return ($fields[1] ? $fields[1] : "Extension $mbox in $context", $category);
 				}
 			}