BES 4.1 Role Based Administration Rights

Role	Functionality
Security Administrator (rim_db_admin_security)	This role can perform all tasks. This role is the only role that can manage role membership or change sensitive security properties, such as licenses and encryption keys.
Audit Security Administrator (rim_db_admin_audit_security)	This role can view the same options as the Security Administrator role, but it cannot change or update any of these options.
Enterprise Administrator (rim_db_admin_enterprise)	This role can perform all tasks relating to BlackBerry smartphone users, services, servers, and global application data. This role can control the services in the BlackBerry Enterprise Server, but cannot view role membership, licenses, or encryption keys.
Audit Enterprise Administrator (rim_db_admin_audit_enterprise)	This role can view the same options as the Enterprise Administrator role, but it cannot change or update any of these options.
Senior Help Desk Administrator (rim_db_admin_sr_helpdesk)	This role can perform all BlackBerry smartphone user management tasks, including deleting BlackBerry smartphone users, changing IT policy assignments, and issuing IT administration commands.
Audit Senior Help Desk Administrator (rim_db_admin_audit_sr_helpdesk)	This role can view the same options as the Senior Help Desk role, but it cannot change or update any of these options.
Device Administrator (rim_db_admin_handheld)	This role can perform all tasks that relate to BlackBerry smartphone users and BlackBerry smartphone management. This role is designed for administrators who support new BlackBerry smartphone users and deploy BlackBerry smartphones.
Audit Device Administrator (rim_db_admin_audit_handheld)	This role can view the same options as the Device Administrator role, but it cannot change or update any of these options.
Junior Help Desk Administrator (rim_db_admin_jr_helpdesk)	This role can perform BlackBerry smartphone user account management tasks, including creating and sending wireless enterprise activation passwords, and resending service books or IT policies. This role cannot add, move, or delete BlackBerry smartphone user accounts or send certain IT administration commands. This role can assign audit roles.
Audit Junior Help Desk Administrator (rim_db_admin__audit_jr_helpdesk)	This role can view the same options as the Junior Help Desk role, but it cannot change or update any of these options.

Source: http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB04889&sliceId=1&docTypeID=DT_SUPPORTISSUE_1_1&dialogID=92044347&stateId=1%200%2092038889

More information can also be found in the BES 4.1.6 Administration Guide at http://na.blackberry.com/eng/deliverables/2755/Admin_X_493311_11.pdf