Permission to Reset Passwords

In Active Directory Users & Computers, create a service account user
(ex, iiQ.Passwords)

In Active Directory Users & Computers, make sure View > Advanced Features is enabled

Right-click on the root of the domain, choose “Delegate Control…”

Add in your service account

Delegate the following common tasks: Reset user passwords and force password change at next logon (Next > Finish)

Right-click on the root of the domain again, choose “Delegate Control…”

This time select “Create a custom task to delegate”

Only the following objects in the folder: User objects

“Property-specific” only, check Read & Write lockoutTime (Next > Finish)