Permissions

What are mininum permissions needed to give a tech or helpdesk the ability to change passwords? Or is there another way or something else? I do not want to give them domain admin rights.