OR...

Just get the brilliant 'Groups' module from kaotik

http://www.kaotik.biz/download/groups_module.rar

No core file hacks required. With this you can disable 'groups' permissions for the 'executives' group and after adding a new member via 'edit user' they can put them into groups using the module. Prevents access to the webmaster account too.

Excellent work

This module looks very good. I have it installed but must not be setting it right.

I have...

--------------

Permission for each Group
Set which groups each group can change

Webmasters

Webmasters = + or -
Registered Users = + or -
Anonymous Users = + or -
Administrator = + or -
All = + or -

Registered Users

Webmasters = + or -
Registered Users = + or -
Anonymous Users = + or -
Administrator = + or -
All = + or -

Anonymous Users

Webmasters = + or -
Registered Users = + or -
Anonymous Users = + or -
Administrator = + or -
All = + or -

Administrator

Webmasters = + or -
Registered Users = + or -
Anonymous Users = + or -
Administrator = + or -
All = + or -


---------------------
And
---------------------


Groups allowed to change permissions
Select which groups can change these permissions

Webmasters

Can Change Permissions All = + or -

Registered Users

Can Change Permissions All = + or -

Anonymous Users

Can Change Permissions All = + or -

Administrator

Can Change Permissions All = + or -

-------------

How would I lock down system module access for "Administrator" only?

Could you please answer + for a check mark or minus for no check mark.

I hope this makes sense...

Set up an 'executives' group and allow them system admin rights to 'Edit User, but NOT 'Groups'.

Also give them module admin rights for 'Group Manager'.

Set the Group Manager module config as below.

Quote:
The top panel settings mean:

Webmaster to do anything in ALL groups
Registered Users can do nothing
Anonymous users can do nothing
Executives group don't have permission to change the 'Webmasters' group (leave un-checked), so they can't add webmasters or REMOVE the webmaster. They can however move users around in the 'Reg Users' and 'Anon Users' and 'Executives' groups. So you can say to clients "create your new user, then open the groups module and add them to the group you want".

The bottom panel just sets who can change the above, so webmasters 'all', others 'none'.

HTH