I'm testing locking down our call managers so a few select users can do nothing more than add/modify new and existing users and also modify phones. I add the "Standard CCM User Management" Role to the group assigned to these select users and they can do all that (including another role for phone administration). My concern is, these basic users can go in and change the passwords of the few users we have designated as full admins. Is there a way I can block these restricted admin users from being able to change anything that has to do with users that are already full admins?