I have delegated control on all containers and OU's containing user accounts to a group called IT-Helpdesk.  At this point they should have full control but although they can check the  "User must ...