---
title: "Preventing Admin Abuse (Logging and Limited Flags)"
excerpt: "Give admins only the flags their role needs, keep activity visible, and log every admin command so you can answer accusations instead of guessing."
category: "administration"
tags: "admin, moderation"
image: ""
read_time: "9 min read"
---
<p>The fastest way to kill a community is a power-tripping admin, and the second fastest is having no way to prove they didn't. AMX Mod X gives you granular access flags precisely so you can hand out limited power, plus activity visibility and logging so nothing happens in the dark. This shows how to build tiered admin roles and keep an audit trail.</p>
<h2>1. Understand the access flags</h2>
<p>An admin's power is a string of flags in <code>addons/amxmodx/configs/users.ini</code>. Each letter grants one capability:</p>
<table>
<thead><tr><th>Flag</th><th>Grants</th></tr></thead>
<tbody>
<tr><td><code>a</code></td><td>Immunity (cannot be kicked/banned by others)</td></tr>
<tr><td><code>b</code></td><td>Reservation (reserved slot access)</td></tr>
<tr><td><code>c</code></td><td>amx_kick</td></tr>
<tr><td><code>d</code></td><td>amx_ban / amx_unban</td></tr>
<tr><td><code>e</code></td><td>amx_slay / amx_slap</td></tr>
<tr><td><code>f</code></td><td>amx_map (change map)</td></tr>
<tr><td><code>g</code></td><td>amx_cvar (change cvars)</td></tr>
<tr><td><code>h</code></td><td>amx_cfg (exec configs)</td></tr>
<tr><td><code>i</code></td><td>amx_chat / admin chat</td></tr>
<tr><td><code>j</code></td><td>amx_vote</td></tr>
<tr><td><code>l</code></td><td>amx_rcon (run RCON commands)</td></tr>
<tr><td><code>u</code></td><td>Menu access</td></tr>
</tbody>
</table>
<p>The lazy move is to give everyone <code>abcdefghijklmnopqrstu</code> — full admin. That is exactly how a trusted regular ends up able to <code>amx_rcon</code> your <code>rcon_password</code> out of the server. Grant roles instead.</p>
<h2>2. Build tiered roles</h2>
<p>The <code>users.ini</code> line format is <code><authid or name> <password> <access flags> <account flags></code>. Account flag <code>c</code> means the first field is a SteamID; <code>d</code> means an IP; <code>e</code> means name-only with no password. A sensible three-tier setup:</p>
<pre>; Moderator: kick, slay/slap, chat, menu — no ban, no cvar, no rcon
"STEAM_0:1:1001" "" "ceiu" "ce"
; Admin: adds ban and map control, still no rcon/cvar
"STEAM_0:1:1002" "" "abcdefiju" "ce"
; Owner: everything, including rcon
"STEAM_0:1:1003" "" "abcdefghijlu" "ce"</pre>
<p>Note the deliberate omissions: moderators get no <code>d</code> (ban), no <code>g</code> (cvar), no <code>l</code> (rcon). Reserve <code>l</code> for people you would trust with the server password, because that is effectively what it is.</p>
<h2>3. Keep admin actions visible</h2>
<p>Hidden admin actions breed accusations you cannot answer, so announce them:</p>
<pre>amx_show_activity 2</pre>
<p>At <code>2</code>, players see both the action and the admin's name. This is covered in full in the <a href="/tutorials/amxx-cfg-explained">amxx.cfg guide</a>; the point here is that transparency is itself an abuse deterrent — an admin who knows the whole server sees their name on every slap behaves better.</p>
<h2>4. Log every command</h2>
<p>AMXX writes admin commands to its logs under <code>addons/amxmodx/logs/</code> and to the game logs. Make sure logging is on (<code>amx_logging 1</code> in amxx.cfg, <code>log on</code> in server.cfg), then audit periodically:</p>
<pre>grep -iE 'amx_(ban|kick|slay|slap|map|cvar)' cstrike/logs/*.log</pre>
<p>This is the record you produce when someone claims they were banned for no reason. The full technique is in <a href="/tutorials/parse-cs16-server-logs">parsing server logs</a> — grep by the admin's SteamID to see everything they have done.</p>
<h2>5. Protect the escalation paths</h2>
<ul>
<li><strong>Immunity is not a toy</strong> — flag <code>a</code> means no one else can act on that admin. Give it only where it is needed, or a rogue admin becomes untouchable.</li>
<li><strong>Never grant <code>g</code> (cvar) or <code>l</code> (rcon) casually</strong> — with <code>amx_cvar</code> an admin can change <code>sv_cheats</code>, rates, or gravity; with rcon they own the box.</li>
<li><strong>Prefer SteamID auth (<code>c</code>)</strong> over name-only (<code>e</code>) — name-only admin is trivially impersonated by anyone who copies the nickname.</li>
</ul>
<p>A useful mental model: treat flags the way you would treat filesystem permissions. Nobody runs as root for daily work, and nobody should hold <code>l</code> (rcon) or <code>a</code> (immunity) just because they are "senior." Start every new admin at the moderator tier, and promote only when a concrete need appears and the person has earned trust. Demotion should be just as routine — pull a flag the moment a role changes, and reload admins so the change is live immediately rather than at the next map.</p>
<h2>Troubleshooting</h2>
<ul>
<li><strong>An admin can do more than intended</strong> — too many flags, or they inherited access from <code>amx_default_access</code> in <a href="/tutorials/amxx-cfg-explained">amxx.cfg</a> (which must stay empty). Trim the flag string.</li>
<li><strong>Everyone has admin</strong> — a flag was left in <code>amx_default_access</code>. Set it back to <code>""</code>.</li>
<li><strong>Admin cannot authenticate</strong> — account flag mismatch: <code>c</code> for SteamID vs <code>e</code> for name-only, or a password field that does not match their <code>setinfo</code>.</li>
<li><strong>No audit trail</strong> — <code>amx_logging 0</code> or <code>log off</code>. Turn both on; without them you cannot prove anything.</li>
<li><strong>Cannot act on a misbehaving admin</strong> — they hold immunity (<code>a</code>). Remove it from <code>users.ini</code> and reload admins.</li>
</ul>
<h2>Verification</h2>
<p>Reload the admin list and confirm the flags took:</p>
<pre>amx_reloadadmins</pre>
<p>Log in as the moderator account and confirm <code>amx_ban</code> is refused (<code>You have no access to that command</code>) while <code>amx_kick</code> works. Perform a slap and confirm the on-screen message names you at <code>amx_show_activity 2</code>. Finally grep the log and confirm your test action was recorded. When all three hold — limited flags, visible activity, logged commands — your admin team is accountable.</p>
