I just create a cn name test, and in test, I create a group name secunion, and create two user user1, user2, I add user1 to group secunion, and I give user2 reset password privileges to secunion's user
According to Active Directory privilege inhertance, the user1's security attributes will have an attribute, that the user2 have privilege to change his password, but not，and users also can not change user1's password.
Thanks for anyone who can help me.