Delegate Control of OU Help Needed

[Tester]

I need to delegate control of an OU called LA to a regular domain user
called smary. The user needs to be able to perform the following:
1.Create new user accounts entering only the info on the General, Address,
Account, Telephone, Organization Tabs.

2. Modify those same attributes for any user moved into the LA OU even if
smary did not originally create the user.

3. Reset the password for any user, including the password must be changed
at next login, in the LA OU regardless of who orginally created the user.

4. Must NOT be able to move or delete a user in the LA OU.

Normal delegation works fine for any user that smary creates in the LA OU
but, if the user was created by an administrator in another OU and then
moved into the LA OU then smary can not reset the password or enter or
update the attributes listed on the General, Address, Account, Telephone,
Organization Tabs.

I can't figure out how to make it work as needed. I would appreciate
directions (I am new at this) on how to do this.

Thanks for the help!!

 

[Herb Martin]

OU & Objects there (users, computers) permissions work like
DirectoriesFiles.

The "inheritance" is done when the object is created -- this is the way
inheritance
(of physical characteristics) is done in biology too.

Moving something into an OU will not change the permissions already assigned
-- either explicilty to the object OR via inheritance from the (former)
parent.

Reaply (or even reset-reapply) will be necessary.