Trying to remove the right to edit users' group membership?

[telemorgan]

I am trying to deny the ability for our helpdesk to modify users' group memberships. Our helpdesk (group name = 'helpdesk' in AD) can go into AD and modify user accounts in the USERS OU. That 'helpdesk' group in AD have specifically been granted permissions on the USERS OU to 'List Contents', 'Read All Properties' and 'Write All Properties'. They have to be able to edit other atributes of the user account, I just want to try to DENY this one ability.

Does anyone know what permission it is that allows\deny the ability to change group membership for a user object?

Thanks