I want to have my helpdesk staff to have access in console one, but I only want them to be able to remote control PC's to help the users and change user passwords.

Is this possible? If so how do I go about doing it?