Delegation of rights in AD, how?

Question

Active Directory

Greetings!
There is a task to give rights to a group as a domain to admins, but without the ability to create or delete users. I do through delegation. On the permishin tab, I do this:

i.e. I put Full Control, and then I remove the checkboxes from Create and Delete.
As a result, a member of this group can still create a user, but swears that there are not enough rights to set a password, and the user will be created "blocked". And so it happens. A member of the group also has the ability to delete a user.
What am I doing wrong? What rights should be given/taken away?

Answer 1

Check out this article https://habrahabr.ru/post/174437/
Starting with "Determining tasks for which delegation has been granted"