question

Hi,
Based on my understanding ,you want to assign permission to a user to access the ADUC from a member server or workstation, right?
It don't need the domain admin permission to do this.
The default security is read for Authenticated Users. As following:

For the special permissions is :read permission and read all properties permission.

If you don't have the permission, we need to assign the permission the users.
Right click the domain name or OU name from ADUC on DC.
From the security ,add the user and assign the permission as above screenshot showing .

Best Regards,

Hello!
Thank you for your answer.
There is no problem with access to this snap-in. Look at your picture - (everyone - Read all properties)

But I forgot to say that is new administrator (junior) and He need to do admin work on users account on serwer. I mean he need create new user, add to group, change password etc, etc. Now he have only read. If I'll put his account in domain admin group, he can do what he need, but I don't want to do yet. Is another way to do it?

Hi,

You can delegate the admin account to manage user and computer accounts on each OU level using wizard delegation :

You can refer to the links below :

delegating-administration-by-using-ou-objects

delegate-permission-reset-ad-user-account-passwords

Please don't forget to mark helpful reply as answer

Thank You, works great!

Echm ... but is possible to revoke this delegation? :DDD

Thameur-BOURBITA - I've found - Security :D

Thank you again !

All works great! Thank you.
But I wonder how I can check what does he do in snap-in computers and users. Its possible to check it?
Have you maybe any any idea?

Hi,
If you want to Audit account management, you can refer to: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-account-management