I need to provide a list of all the users who can reset other users' passwords. e.g. Service Desk Staff, Domain Admins etc.
This might have been delegated at a specific OU or at domain level. Is there a way to query AD to output ALL users who have this facility at ANY level of the OU structure?