Since CRM 2011 till version 9 (on-premise), we could not create a Security Role which can change the Username (Domain Name) field in the User form. Only the System Administrator security role can update the Username field of other users.

Even if you give all privileges to the Security Role, when user tries to change the username of another user, the following error is thrown ‘Unable to Change Domain Logon Name’.

We suggest that CRM V9 On-Premise should have the ability to configure a Security Role which given the special privilege will be able to change the Username field of other users.