There are right and wrong ways of managing users on your website - this guide explains how to add, edit, and remove user accounts.
In out-of-the-box Sector, only sitebuilders (Drupal administrators) are able to manage user accounts.
User management has critical security implications so should only be done by users with the required security level - learn more in Managing user accounts - who and why and in Preconfigured user roles, user profiles and permissions.
In this guide
To add a new user, use the AdminUI toolbar and navigate to People > Add a new user
From the 'Add user' screen, you can:
- Assign the user a role, or multiple roles (learn more about roles in our article on preconfigured user roles).
- Set the user's email address, username, and password.
- Notify the user of their new account - this will send them an email with a link that allows them to log in and change their password (they don't need to know the password you set for them).
You can see a table of all user accounts by navigating to People in the AdminUI toolbar.
Edit a user by clicking the 'edit' button in the operations column. This allows you to change the details that were set for the user account.
If you need to block or unblock a user's account (e.g. if their password has expired), this can be done by changing the status ( 1 ) - either to 'blocked' or 'active'.
Do not cancel user accounts without a cancellation policy. If you don't have a policy set up, discuss the process with your team. Government entities need to consider compliance with legislation around public records, official information, and privacy, as well as with auditing requirements. The private sector entities needs to consider copyright and privacy policies. All user administrators need to understand what each cancellation option means for their specific site.
At the bottom of the user edit screen is an option to 'cancel account' ( 1 ). Clicking this gives you a number of options for how the account is cancelled.
If you are cancelling the account of an editorial user who has created or edited content on your site, you need to make sure you don't accidentally delete the content they worked on too. The first option - 'disable the account and keep its content' - is the safest option if you want to keep the content and keep track of who authored it.