How to limit the domain user , grant then create object permission only and remove the delete rights?

Hi,

I have windows 2008 R2 level domain ,   I have a new temp admin , and I need that use can

create users
change user's Password
Grant groups to Users  ( cannot grant domain admins)

but I dont want the user can delete anything.

can I archive this to get more security?