In Drupal, how can I set a role to allow/deny user account requests but not be able to change User 1's password? I created a Drupal 6 site for a client which I, as user #1, will edit and maintain. However, I want the client to be able to allow/deny new authenticated user requests. I have created a new role and assigned it the following user permissons:


access user profiles
administer user
change own username


This works and the users with that role can manage new user requests exactly like I want. However, they now also have the ability to change the User 1 password and do some serious damage to the site.

Is there a setting, permission, or module I can use to prevent this?
User protect: protects specific fields of users from being edited.
Administer Users by Role: lets you decide which roles a user can edit. Assign a dummy role to the admin user and give permissions for every other role.


First one says it is complicated, second one may be a pitfall if you add new roles but don't give access to edit them.