Change Password Restrictions

We are a 4.12 shop and we want to give access to change passwords/intruder lockout to our operators and helpdesk with giving them full rights to the tree. We tried to create an organizational role and it is not working for us. Do you know how to create this role correctly? or Is there a utility that will allow users/group to change passwords and uncheck intruder lockouts only?