we have zenworks7sp1, on nw6.5sp5

we want to create a zenworks administrator, that only can do
administrating in zenworks, not the rest of edir!

he should create application etc
distrubute them
do remote access of workstation etc all with zenworks objects etc

but he was not allowed to change maybe user password, or start to craete
user / goups ,

is it possible to do so ? what must i do to confidure it out, what rights
does he need?