How to prevent Users in Domain Admin to create another a new user and add this new user into Domain Admins group

Hi ,

question1:

i have to share some priviliges to CM facotory local IT,so ,i create another account and add it into domain admin group,but i donot want local IT to use my Domain admin account or change my password. e.g.there are 2 users in domain admin group (User_A and User_B,in windows server 2003 or 2008).How to prevent User_B to create a new user(e.g User_C) ,and add this new user into domain admin group.(keep User_A's right here).B

question2:

also for 2 domain users, how to prevent User_B to change User_A's password.

thanks very much