Restrict Users from creating + editing higher level accounts, but still able to create + edit lower level accounts I'm trying to restrict the permissions of a custom user role so that they can create, edit and delete lower level accounts, but not have any access to create or edit Administrator accounts. 

I've already tried Administer Users by Role and User Protect, but neither of these provide the functionality I need. 

User protect allows me to lock down my Admin account, but a lower level user can still create an administrator account if they want. Administer Users By Role features an permission for 'Create new users', but no permission to restrict the level of user each role can create. 

What I need is for a Sub-admin to be able to create and edit sub-admin accounts, but not create or edit Administrator accounts. Is there any way to achieve this?
I finally Discovered the Role Delegation module, which provides the exact functionality described above. Apparently Role Assign also does a similar trick. 

Both, however, allow the assigning of multiple roles to a single user, rather than forcing a single role. This allows a user to apply multi-layered permissions to a single user. 

If there's any way to force a single role choice, it would be perfect. 

Update

I tweaked my copy of the Role Delegation module to show radio checkboxes instead of conventional checkboxes. It doesn't inherit settings like 'default role for new users', but it avoids this multi-user issue.