question

Hi,
Based on my understanding ,you want to assign permission to a user to access the ADUC from a member server or workstation, right?
It don't need the domain admin permission to do this.
The default security is read for Authenticated Users. As following:

For the special permissions is :read permission and read all properties permission.

If you don't have the permission, we need to assign the permission the users.
Right click the domain name or OU name from ADUC on DC.
From the security ,add the user and assign the permission as above screenshot showing .

Best Regards,

Hello!
Thank you for your answer.
There is no problem with access to this snap-in. Look at your picture - (everyone - Read all properties)

But I forgot to say that is new administrator (junior) and He need to do admin work on users account on serwer. I mean he need create new user, add to group, change password etc, etc. Now he have only read. If I'll put his account in domain admin group, he can do what he need, but I don't want to do yet. Is another way to do it?

Hi,

You can delegate the admin account to manage user and computer accounts on each OU level using wizard delegation :

You can refer to the links below :

delegating-administration-by-using-ou-objects

delegate-permission-reset-ad-user-account-passwords

Please don't forget to mark helpful reply as answer

Hi,
If the user need to create new user, add to group, change password etc, you can use the delegation control to grant proper permissions without add it to admins group.
Right click the domain name or OUs which you want to assign permission:


Select the permission you want to assign, or you can try to customer a task: