[389-users] service desk account can no longer modify passwords

We have a service desk account that I created in our LDAP that has the ability to add/delete/modify all our user accounts. Except that now that we have password policy in place, it can no longer modify our user account passwords. I have confirmed that the password changes that it is doing conform to our password policy, but every time it comes back with constraint violation. But I can do anything with password changes as directory manager. One thing that I haven't confirmed is whether the accounts that they are trying to change are accounts that have expired. So does anyone know if an account has locked, can only directory manager change the password at that point? Or does anyone know what attributes I would need to have on my servicedesk account to allow it to change these passwords now? I don't want to give them directory manager if I can avoid it but I need to find some way to let them override password policy! thanks, EJ