It is great to see that you can specify which parent OU's the helpdesk have access to. My question is though, can you restrict a sub OU that resides under the parent OU you have granted access to?
For example: DOMAIN\ORGANISATION\ADMINS
I want to grant access to ORGANISATIONS but restrict access to all accounts under ADMINS.