It's really a bit confusing: When you install the module you see the admin account (user 1) on the page "Protected users". So you guess he is protected. Than you try, but he isn't. So you just enable all protections, but this has no effect, user one is not protected from edit of users who has the right "administer users". All the other users without this privilege aren't able to edit other users.

I looked briefly into the large README.txt. It is there, but there is so much Text that it's easily overlooked. Under "SETTINGS:" you can read: "This effectively amounts to no protections. It is suggested that you turn off as many default administrator bypass settings as possible ..."

Improvements:
1) The README is plain text. > I suggest to use Markdown and emphasize **important parts** like the above one.
2) To me it seems to be the most important pitfall that you enable the module and expect that the admin is save ;)
Therefore put it on the module page and somehow on the top of the module: **Enabling this module will not protect any user from being edited by users with the permission "administer users". To achive this you need to change the "Administrator bypass defaults" under "protection defaults". For more informations read the sections SETTINGS and HOW THE MODULE DETERMINES A PROTECTION**

Comments

hunmonk’s picture

The README is plain text. > I suggest to use Markdown and emphasize **important parts** like the above one.

the README will remain plain text, as is the common practice.

Therefore put it on the module page and somehow on the top of the module

too much detail for the project page -- you really shouldn't be putting implementation details there.

i would consider accepting a patch to the README that moves things around for greater clarity, but i have no interest in doing this myself, i'm happy with the documentation as it is.