client administrators for hosted service

[trenco]

Hi,

I'm trying to configure the OTRS system as a hosted service. We're planning to use separate instances of OTRS for individual clients, preconfigured for the specific industry that we're serving. Our clients will be able to modify the defaults but we do not want to give them access to the default admin group because we want to keep some of the options in the SysConfig only for us.
I've created a group called "cadmin" and through various module registrations I gave this group access to some but not all module access - stuff like ticket severity setup, queue setup, etc.

The challenge is the user administration. When I give "cadmin" group access to user and group administration, they can change _all_ users including our admin account and they can also easily give themselves access to the default admin group. Can this be prevented? Is there a way to "hide" the admin group from them and/or at least prevent changes?

Thanks in advance
Peter