We are trying to tighten our security, but thanks to the environment we are in this is a bigger task than it should be. As part of this I have been asked to get a list of users who have the ability to reset other users passwords. there are the obvious suspects, domain admins, service desk etc., but we also appear to have random people who can do this because of a requirement during test or development stages way back. Is there a way to get this, I looked at using powershell but there doesn't seem to be much out there to give me a pointer, things like ADManager+ do not work, when I try to search on permissions it sits there doing nothing then crashes.
Is there a way to build a function using powershell that can do this or is there some third party cmdlet or app that will provide me this info?
Any help gratefully accepted.