Description of problem:
I don't know if this has been on purpose as a feature or if it could be
considered as a bug. Customers are confused about this.
For them, adding a user to the group "cn=admins" is enough to make a user have
the same rights of "admin" user.
But there's at least a Permission missing, that is to be able to do this:
aci: (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalk
 ey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=
 provisioning,dc=cgparente,dc=local")(targetfilter = "(objectclass=posixaccoun
 t)")(version 3.0;acl "permission:System: Reset Preserved User password";allow
  (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User passw
 ord,cn=permissions,cn=pbac,dc=cgparente,dc=local";)
Example:
user "example" is member of admin groups:
ipa group-show admins
  Group name: admins
  Description: Account administrators group
  GID: 142600000
  Member users: admin, example
  Member of groups: ad_users
kinit example
Password for example@CGPARENTE.LOCAL:
ipa user-del test --preserve
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the
'krbLastPwdChange' attribute of entry 'uid=test,cn=deleted
users,cn=accounts,cn=provisioning,dc=cgparente,dc=local'
ipa role-add-member "User Administrator" --user=example
kinit example
ipa user-del test --preserve
Works.