diff --git a/server/handlers/admin.go b/server/handlers/admin.go
index fc7a6ea3..8011b0e9 100644
--- a/server/handlers/admin.go
+++ b/server/handlers/admin.go
@@ -467,6 +467,11 @@ func BanRoom(ctx *gin.Context) {
 		return
 	}
 
+	if creator.IsRoot() {
+		ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot ban root"))
+		return
+	}
+
 	if creator.IsAdmin() && !user.IsRoot() {
 		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot ban admin"))
 		return
@@ -510,7 +515,7 @@ func UnBanRoom(ctx *gin.Context) {
 }
 
 func AddUser(ctx *gin.Context) {
-	// user := ctx.MustGet("user").(*op.User)
+	user := ctx.MustGet("user").(*op.User)
 
 	req := model.AddUserReq{}
 	if err := model.Decode(ctx, &req); err != nil {
@@ -518,6 +523,11 @@ func AddUser(ctx *gin.Context) {
 		return
 	}
 
+	if req.Role == dbModel.RoleRoot && !user.IsRoot() {
+		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("you cannot add root user"))
+		return
+	}
+
 	_, err := op.CreateUser(req.Username, req.Password, db.WithRole(req.Role))
 	if err != nil {
 		ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorResp(err))
@@ -575,6 +585,11 @@ func AdminUserPassword(ctx *gin.Context) {
 		return
 	}
 
+	if u.IsRoot() {
+		ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot change root password"))
+		return
+	}
+
 	if u.IsAdmin() && !user.IsRoot() {
 		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot change admin password"))
 		return
@@ -603,6 +618,11 @@ func AdminUsername(ctx *gin.Context) {
 		return
 	}
 
+	if u.IsRoot() {
+		ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot change root username"))
+		return
+	}
+
 	if u.IsAdmin() && !user.IsRoot() {
 		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot change admin username"))
 		return
@@ -637,6 +657,11 @@ func AdminRoomPassword(ctx *gin.Context) {
 		return
 	}
 
+	if creator.IsRoot() {
+		ctx.AbortWithStatusJSON(http.StatusBadRequest, model.NewApiErrorStringResp("cannot change root room password"))
+		return
+	}
+
 	if creator.IsAdmin() && !user.IsRoot() {
 		ctx.AbortWithStatusJSON(http.StatusForbidden, model.NewApiErrorStringResp("cannot change admin room password"))
 		return