role assignment

i have several IT staffs here who will do helpdesk work, they need to unlock the locked users, change password for users, add computer into win2k domain; and the other domain and system administration work is done a senior administrator. now i just give both help desk staffs and senior administrator domain admin rights for their daily work, it will endanger the whole system. what can i do to give helpdesk staffs the limited rights to do their simple work?
thanks.