The reason they can't user AD, is because they are Helpdesk staff and have no knowledge of Windows or Computers. lol

I would like to make it as basic as possible, they logon, have an icon for resetting passwors and thats it.

No reason for them to get into AD and start mucking up the system.

Thanks