I see tn the docs that you can make a Password Administrators group, like so:
dn: cn=config
changetype: modify
replace: passwordAdminDN
passwordAdminDN: cn=Passwd Admins,ou=groups,dc=example,dc=com
I'm curious though, what privileges does a Directory Administrator have over and above
one of these Password Administrators.