This may be a dumb question, but If a user is enrolled in the Self Service password reset under a policy applied to a specific OU, what happens when the user is moved to an OU not covered by any policy? Are they prevented from using the service at all or simply not allowed to enroll?