Read an Active Directory Security Descriptor
Remove an ACE from a Security Descriptor
Delegate the Send As Extended Right for an Entire OU
Delegate the Receive As Extended Right for an Entire OU
Delegate the Reset Password Extended Right for an Entire OU
Delegate the Change Password Extended Right for an Entire OU
Delegate the Allowed to Authenticate Extended Right for an Entire OU
Delegate the Send As Extended Right for a Single User
Delegate the Receive As Extended Right for a Single User
Delegate the Reset Password Extended Right for a Single User
Delegate the Change Password Extended Right for a Single User
Delegate the Allowed to Authenticate Extended Right for a Single User