This is by design in order for a admin to control a LDAP or Windows group they will need to be a system administrator
With your current configuration the Domain User (testsje) will only be able to configure and manage users in the Domain User (aka Serv-U managed group) and Database Users