I'm in a Drupal 7 installation, trying to find a way to avoid admin-users to edit other admin-user's account.

I've created a role for 'content administrators' and this users tasks involve user administration, but I don't want them to be able to edit other content administrators or admin accounts.

I wasn't able to find an option for this or a module providing the functionality and I'm a bit lost about how this can be achieved.

In D6 I guess could use hook_user() to catch an edit and check the target role in order to allow that edit or not, but this hook is gone on D7. The closest thing is hook_user_alter(), but this is called after the edit, so I can't use it.

Any pointers?

1 Answer 1


Just use the User Protect module.

This module provides various editing protection for users. The protections can be specific to a user, or applied to all users in a role.

Note: User Protect has a complicated configuration -- please take the time to read the very extensive module help before using it!

The following protections are supported:

e-mail address
status changes
OpenID identities
all edits (any accessed via user/X/edit)

When a protection is enabled for a specified user (or the protection is enabled because the user belongs to a role that has the protection), it prevents the editing operation in question that anyone might try to perform on the user--unless an administrator who is permitted to bypass the protection is editing the specified user. The module will protect fields by disabling them at user/X/edit.

User administrators may be configured to bypass specified protections, on either a global or per-administrator basis.

These protections are valid both when trying to edit the user directly from their user/X/edit page, or using the mass user editing operations.

The module also provides protection at the paths user/X/edit and user/X/delete, should anyone try to visit those paths directly.

  • Woah, thanks. It seems was being too picky with my search terms. This works great for me, just what I needed. Also, I like the approach (you just can't see the form if you don't have access to a field/user, it would be a nice way to implement this without a single module).
    – Adirael
    Aug 4, 2011 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.