What's the best way to isolate users from an admin process they initiate?
<p>I need to write some software using C# that allows web users to do various admin tasks in our application and in active directory, even though their user accounts will not be granted the permissions to do so directly. They will visit a web page whilst logged into AD as standard users but be able to click buttons that perform basic tasks in AD. For example, some users will be permitted to reset the passwords of their subordinates or modify their name due to marriage.</p>

<p>What's the best way to implement this securely?</p>
