How can I get a list of users with reset password ability?

Question

We are trying to tighten our security, but thanks to the environment we are in this is a bigger task than it should be. As part of this I have been asked to get a list of users who have the ability to reset other users passwords. there are the obvious suspects,
domain admins, service desk etc., but we also appear to have random people who can do this because of a requirement during test or development stages way back. Is there a way to get this, I looked at using powershell but there doesn't seem to be much out there
to give me a pointer, things like ADManager+ do not work, when I try to search on permissions it sits there doing nothing then crashes.
Is there a way to build a function using powershell that can do this or is there some third party cmdlet or app that will provide me this info?
Any help gratefully accepted.

Answer 1

Hi,
Based on my knowledge, except for those default groups users, such as domain admins and enterprise admins and so on, have reset password ability for other users, we can use delegation control to give other common users permissions to reset password for others,
to view or delete Active Directory Delegated Permissions, please go through the below article:
https://social.technet.microsoft.com/wiki/contents/articles/6477.how-to-view-or-delete-active-directory-delegated-permissions.aspx
And if you were editing single user's security tab to give specific users reset password permissions, then I think we should create a script to get all those users, for scripting, please also post in the official scripting guys forum:
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/home?forum=ITCG
Regards,
Yan Li
Regards, Yan Li