The answer by Greg Askew is correct regarding the
Reset Password permission that needs to be delegated, and they should get the answer credit, but I'm supplying some easier options, if it's not a bulk operation.
First, I suggest creating an AD group to delegate the permission to - eg. "StaffPasswordReset" or whatever. You may want to grant other users or groups the same right, and it stops your ACLs getting messy when you add others.
There's three main options (other than scripting) to grant the permissions, starting with the easiest, by far.
Right-click on the OU and run the
Delegate Control wizard on the OU. Literally the second pre-configured option is
Reset User Passwords and Force Password Change at next logon. Select the account or group to delegate the permission to, and then you're done.
In ADSIEdit, or in AD Users and Computers with Advanced View enabled, you can grant
Reset Password to the user or group on the Security tab for the OU.
Or you can use
DSACLS, which is still significantly easier than the Powershell method.
dsacls "OU=OUName,dc=example,dc=com" /I:S /G "[mydomain\delegate]:CA;Reset Password";user
Note: For options 2 and 3, since you've assigned
Write All Properties already, presumably to Users, that should be sufficient. For option 1, the wizard sets all the required perms for resets.
However, if you only want to delegate password resets and don't want to grant "Write All Properties", you also need to add permissions to write to the user
lockoutTime properties (as well as grant
Reset Password). Again, either in the Security tab for the OU or with
dsacls "OU=OUName,dc=example,dc=com" /I:S /G "[mydomain\delegate]:rpwp;PwdlastSet";user
dsacls "OU=OUName,dc=example,dc=com" /I:S /G "[mydomain\delegate]:rpwp;lockoutTime";user
Write Member is about granting permissions to add/remove Group members. Is this what's required? Do you have groups in the same OUs (or under the same parent OU) as users? If not, I'd suggest delegating that separately.