Learn how to update the Group Policy Management Console (GPMC) to prevent IT administrators from setting passwords in this new Ask an Admin post.
Missing those domain admin rights? Configure a management group on workstations so that IT staff can provide support without full access to Active Directory.