Hi Bruce

Hm, if a domain admin has already to much rights for your purposes you could either create a own global group and stuff it with the needed rights like Ed proposed or make the guy a member of "server operators" which would grant him the right to alter users.

I can only second you about the lack of documentation here, but hey don't forget, the MCSE's would have much less work, if every "dumb" user like us could manage a NT server that easy ;)

Btw some stuff about those rights you can find in the online help of the UserManager (the one for the server, that you can also use for remote access).
It's located on the NT server Install disk in a folder named "client" I think.
More info is only provided by books (especially those for preparing the exams of course) afaik.

HTH
Markus