I created a Drupal 6 site for a client which I, as user #1, will edit and maintain. However, I want the client to be able to allow/deny new authenticated user requests. I have created a new role and assigned it the following user permissons:

  • access user profiles
  • administer user
  • change own username

This works and the users with that role can manage new user requests exactly like I want. However, they now also have the ability to change the User 1 password and do some serious damage to the site.

Is there a setting, permission, or module I can use to prevent this?

1 Answer 1

  • User protect: protects specific fields of users from being edited.
  • Administer Users by Role: lets you decide which roles a user can edit. Assign a dummy role to the admin user and give permissions for every other role.

First one says it is complicated, second one may be a pitfall if you add new roles but don't give access to edit them.

  • Administer Users by Role does exactly what I need. Thanks.
    – Tantalus
    Dec 8, 2011 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.