Deny write access to new accounts

[beren beren]

Hi.
Is it possible to make admin Bob unable to edit accounts (delete, create,
change passwords)created this year ? There is an idea to move them to a
group or OU and give Bob the rights to write only there. Is there a more
elegant solution ?