The steps involved to set delegation for a AD user or group to reset account password permission.
Step 1: Open Active Directory Users and Computers. Right click on the domain and choose Delegate Control
Step 2: In the Delegation of Control Wizard, click Next
Step 3: In Users or Groups window, select the user or group to whom you want to delegate control
Step 4:In Tasks to Delegate,
- Choose ‘Delegate the following common tasks‘
- Select ‘Reset user passwords and force password change at next logon‘
- Click Next and Finish
Optionally, if you need to provide account unlock permission, then
- Right click on the user or group to be granted permission, and select Properties
- Select Security tab and click Advanced
- Click Add
- Choose Select a principal and enter the user or group that needs to be granted reset permission
- Click Ok
- In the Applies to field, select Descendant User Object
- Scroll down and enable, Read lockout Time and Write lockout Time
- Click Ok
