You can actually doing the following to achieve the same thing:
- Create a new Windows administrator account, let's say SecureAPlus, and protect it with password.
- Modify the Managed User Rights, remove the administrators from the trusted groups, and add SecureAPlus to the trusted users list.
In this case, only the person that can login as SecureAPlus, can modify the SecureAPlus settings.