Best method of delegating password resets

Hi guys,

I am looking to develop an ASP.Net application that will allow a user to reset Windows domain passwords for anyone they are the manager of. For example: Finance manager can reset the password of anyone he is listed as a manager of in Active Directory.

I was wondering what the best way to do this was in terms of accessing Active Directory. Should I have a service account created which I call using my code, should I give all users access to reset AD passwords (they are unable to install software - like RSAT - on their terminals so this seems pretty safe), or should I use a third method I am not aware of?

If anyone could please tell me the best solution for this that would be great.

Thanks!