Setting up Password Assistance through AD

In Active Directory Users & Computers, create a service account user (ex: iiQ.Passwords)

In Active Directory Users & Computers, make sure View > Advanced Features is enabled

Right click on the root of the domain, choose “Delegate Control...”

Add in your service account

Delegate the following common tasks: Reset user passwords and force password
change at next logon (Next > Finish)

Right-click on the root of the domain again, choose “Delegate Control…”

This time select “Create a custom task to delegate”

Only the following objects in the folder: User objects

“Property-specific” only, check Read & Write lockoutTime (Next > Finish)