I am doing a trial setup of ADSS+ and have all but one element working. Ours is a multi-organization forest so we have top level OU's that represent individual organizations. Each of these have a PSO (fine grained password policy applied). Due to the above setup the account we use cannot be a domain admin and I have given the basic permission outlined in the guide. 

It does not work and I do not see the proper password policy when I login as an end user. I looked around on AD and set a couple of PSO related permissions from the delegate control wizard. However, that didn't work either.

Could you please let me know exactly what permissions are required on what for ADSS+ to see fine grained password policies properly?

Regards,

Kahthan