You need to configure the permissions for the help desk employees as defined by the written domain administration
You need to ensure that when the new version is installed, users do not lose any personal settings that they made in the existing version
You need to ensure that the security settings in the GPO are applied immediately after linking the GPO to the OU