Check the boxes opposite groups of SharePoint users who will be able to create and clone AD users.

groups_allowed_to_create_and_clone_ad_users_1