Prevent Work Item from being deleted in TFS 2015-2017

I am administering a TFS 2015 server, soon to be upgraded to 2017.

Is it possible to prevent a work item from being deleted?

• Early versions of TFS did not allow deletion - So is there any config or extensions that prevent it.

How will this potential fix, act when updating to 2017?

You can easily take away delete permissions from any group you want. It is probably sufficient to set the permissions for the Contributor group in this case:

But you can apply the permission at any level

However keep in mind that when a user is a member of a couple of groups, lets say Contributors and Administrators, the permissions which are set as denied for Contributors also override these permissions for this user in the Administrator group (even when the permissions in the Administrator group are set to Allow).
If you don't want that, you could use 'Not set' in the Contributors group. Which means that users who are only a member of Contributors don't have that permission. And when users are a member of Contributors and an other group, will still have those permissions when they are set to Allow in that other group.