Other than creating a new OU for administrators, is there a way to prevent Helpdesk Techs from changing the Administrators passwords and gaining full access to AD?

Cheers

Rob