Minimum permissions are needed for a delegated administrator to force password change at next logon procedure

You can use the Delegation of Control Wizard to delegate the
Reset Password permission to the delegated user. Whereas, in order to change the "User must change password on next logon" flag, the delegated user must have write permission to the user containers. However, the write permission provides the delegated user with additional permissions. In other words, the Write Account Restrictions permission is a super permission that provides access to some other user properties. The pwdLastSet property can be used to force the user to change their password at next logon. By default, the individual permissions are not visible. The filtering of the permissions is controlled by values in the Dssec.dat file. To resolve this issue, you can use the following steps to delegate permissions for only the Reset Password and pwdLastSet property to a user-defined group named Help Desk.

1. Disable the filter for the user permissions:
   
   1. Click
      Start, click Run, type
      Dssec.dat in the Open box, and then click
      OK.
   2. Click Open With, click
      Notepad, and then click OK.
   3. In the [User] section, edit the pwdLastSet value by changing pwdLastSet=7 to pwdLastSet=0.
   4. Quit Notepad.
   Note Do not change the value of pwdLastSet in the [Computer] section. By default, the pwdLastSet value does not exist in the [User] section of the Dssec.dat file on Windows Server 2003. Therefore, if you are running Windows Server 2003, you need to add it manually.
2. Delegate the permissions to the Help Desk group:
   
   1. Click
      Start, click Run, type
      dsa.msc in the Open box, and then click OK.
   2. Right-click the organizational unit to which you want to delegate permissions, and then click Delegate Control.
      
   3. Click Next, and then click
      Add.
   4. Click Help Desk, click Add, and then click
      OK.
   5. Click Next, check
      Create a custom task to delegate, and then click
      Next.
   6. Click Only the following objects in the folder, click to select the User objects check box, and then click Next.
   7. Click to select the General and the Property-specific check boxes.
   8. Click to select the Reset Password, Read pwdLastSet, and Write pwdLastSet check boxes in the Permission box.
   9. Click Next, and then click
      Finish.
3. Enable the filter for the user permissions:
   1. Click
      Start, click Run, type
      dssec.dat in the Open box, and then click
      OK.
   2. Click Open With, click
      Notepad, and then click OK.
   3. In the [User] section, edit the pwdLastSet value by changing pwdLastSet=0 to pwdLastSet=7.
   4. Quit Notepad.

Additionally, if you want to verify the security changes, you can follow these steps:

1. Click
   Start, click Run, type
   dsa.msc, and then click OK.
2. On the View menu, select Advanced Features.
3. Right-click the organizational unit that you delegated permissions to and then click Properties.
4. Click on the Security tab, click the Help Desk group, and then click Advanced.
5. Click Read/Write Property on the
   Permission Entries, and then click
   View/Edit.
6. You can see that only the Read pwdLastSetand the Write pwdLastSet properties are set to
   Allow, but the Help Desk does not have access to any other properties.