#1 - These rights have to be granted in active directory itself: http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html
#2 - Could you clarify what kind of further rights you are referring to? By default, everyone in your domain has access to the Lansweeper web console. Access can be restricted as explained
here. Users can either see and modify everything or see and modify nothing. Role based access is not currently possible, but will be implemented in Lansweeper 5.0. We expect to have a 5.0 beta release ready by October.