How can you delegate the ability to view users change history?
Perhaps the easiest way to delegate this is to:
1. Create a group (universal security) and make any user you want to have access to change history a member of this group
2. From the ARS MMC console, navigate to the 'Configuration | Access Templates' area
3. Right-click and choose 'New Access Template'
4. Give the name "View User Change History"
5.On the access permission area, click the ADD button
6. Choose 'Only the following object classes' radio button and select "Users" followed by the NEXT button
7. Choose 'Object access' radio button followed by this permission:
View Change History
8. Apply this access template to your domain, along with 'All objects - view all properties' and you will be able to view the change history of any user.
If 'All objects read all properties' is too much access, you can apply: