How can an Administrator change Call Forwarding or DND for a user?

The good news - it is dead simple from the CLI to change this. You just clear the Asterisk database setting for the CF. The DND has a similar setting in the database. It is also simple enough to log into the UCP interface as the user and change the setting while in there.

The bad news - the phone could be doing the DND and CF. Depending on your phone and how the user did it, there may be no way from anywhere but the phone to turn these features on and off. Even UCP will not change the setting if the phone is the culprit.

If you want the extensions settings module to be able to do this, submit a feature request.