Restrict the Domain Admin

[sf_mail_sbm () yahoo com]

Hi List,
Is there a way to restrict access of a Domain Admin?

Example, can we allow a Dommain admin to do everything EXCEPT user management (e.g. password reset)? 

We want to secure our environment, and do not want to have "ALL-POWERFULL" domain admins around

Thanks for your suggestions

P.S. Environment: Windows (2000 & 2003) - Active Directory