As well as the three standard roles for a D7 site, I have created a role for a lesser admin / content creator. This role is essentially an administrator role with some of the juicy bits taken away.
I would like that users assigned this role can manage other users, but I need to restrict it so that they cannot assign or remove the administrator role, or edit an administrator's profile and account. I can't see a way to do that on the standard installation, is there a module that could help me?
Edit: I have looked into the userprotect module. While it does prevent a lesser admin from editing an administrator, it does not prevent them from granting the administrator role on themselves.