1.
You do not give any power at all to the 'Group Modify Power' if you dont want that group to have any power to modify!
What you need to edit, is to set the following, if you haven't done so:
- Needed Group Modify Power
- Needed Group Member Add Power
- Needed Group Remove Power
The 'needed' permissions options are the one that says what is the power level needed to modify the selected group.
You set those options above to have the power level of what a 'Server Admin' has.
In the following example, Server Admin and Deputy Admin has the right permissions, but Assistant Admin has the wrong/mistaken permission.
'Server Admin' has
- Group Modify Power set to '75'
- Needed Group Modify Power set to '75'
'Deputy Admin' has
- Group Modify Power set to 'nothing'. Right Click and 'remove permission' if you haven't done so.
- Needed Group Modify Power set to '50'
'Assistant Admin' has
- Group Modify Power set to '50'
- Needed Group Modify Power set to '50'
Now, with the permissions above:
- Server Admin can modify the group of Deputy Admin & Assistant Admin, because it has higher permission level than what is needed on the others.
- Deputy Admin can NOT modify the group of itself (Deputy Admin) or any other group, because it does not have ANY modify power than what is needed on the others.
- Assistant Admin has the power to modify Deputy Admin, because it has the permission level same as the what is needed to modify 'Deputy Admin'.
- Assistant Admin does not have the power to modify Server Admin, because it has a lower level (50) than what Server Admin requires (70)
What is VERY important to set is the 'Needed [type of permission]', otherwise, you guests will have the power to modify any other group that doesnt have that set, and new created groups will also have the power to modify if the other doesnt have it set.
2.
'Modify Virtual Server [bla bla]' is not needed to disable if you havnt messed up and given new users to have the Server Admin as default group.