How to find out who is delegated what access in an Active Directory domain?

I have a very simply question - How to find out who is delegated what administrative tasks in an Active Directory domain?

For example, I'd like to be able to find out and document the following -

  1. Who can reset whose passwords?

  2. Who can create user accounts, and in which OUs?

  3. Who can modify the membership of which security groups?

  4. Who can delete which OUs?

  5. Who can set the "Trusted for unconstrained delegation" setting on computer accounts, on which accounts?

This is one of the most fundamental questions related to Windows Server and Active Directory Security, and what better place to ask this question than on the Windows Server TechCenter forums, where we have so many experts and MVPs who know the technology so well.