I have a system admin that has been dumped from Server Administrator rights due to new security restrictions here. The only server access he really needs is to be able to Add/Remove global users to/from local domain groups I have created, using User Manager.

I have tried setting him to a Server Operator, but that doesn't cut it, he's denied access. Is there any other "lesser user rights" option besides Administrator for him to do his task?