Exact permissions required

Exact permissions required

Can anyone tell me exactly what permissions the service account needs?  Meaning the account that will perform those remote password resets.  I'm consistently being told Domain Admin, but that can't be the minimum required permission level, right?  I'm looking for a bare minimum permission set required.  Anyone have any ideas?  Thank you.
              New to ADManager Plus?

                New to ADSelfService Plus?