My notes, things I have learned, and documentation I have created.

OS: Windows 2012 R2

This is the command I used to grant a group permission to unlock accounts.

C:\> DSACLS “ou distinguished name” /i:s /G “group name“:rpwp;LockOutTime;user

Example:

C:\> DSACLS “OU=MyOU,DC=MYDOMAIN,DC=MYTLD” /i:s /G “MYDOMAIN\MYGROUP“:rpwp;LockOutTime;user