How to restrict users access to Active directory users and computers

How do i restrict IT users from making changes to active directory (adding, deleting, resetting passwords and editing users permissions) in a domain