Modify global user settings

Tier: Free, Premium, Ultimate
Offering: GitLab Self-Managed

You can modify settings for every user in your GitLab instance.

Prerequisites:

You must be an administrator for the instance.

Prevent users from creating top-level groups

You can prevent users from creating top-level groups.

When group creation is prevented:

Users cannot create top-level groups.
Users can create subgroups in groups where they have at least the Maintainer role, depending on the subgroup creation permissions for the group.

To prevent users from creating top-level groups, use one of these methods:

Method	For new users	For existing users
UI	Account and limit settings	User settings in the Admin area
API	Application settings API to modify the `can_create_group` setting	Users API to modify the `can_create_group` setting
Rails console	None	Use the Rails console

Use the Rails console

You can use the Rails console to prevent existing users from creating top-level groups. Use this method when making bulk updates to multiple users.

To prevent existing users from creating top-level groups:

Start a Rails console session.
Run one of these commands:
- To prevent group creation for all existing users except administrators:
```
User.where.not(admin: true).update_all(can_create_group: false)
```
- To prevent group creation for a specific user:
```
User.find_by(username: 'someuser').update(can_create_group: false)
```
Exit the console:
```
exit
```

Prevent users from changing their usernames

By default, users can change their usernames. To prevent users from changing their usernames:

Edit /etc/gitlab/gitlab.rb and add the following line:

gitlab_rails['gitlab_username_changing_enabled'] = false

Reconfigure and restart GitLab.

Edit config/gitlab.yml and uncomment the following line:

# username_changing_enabled: false # default: true - User can change their username/namespace

Restart GitLab.

Prevent Guest users from promoting to a higher role

On GitLab Ultimate, Guest users do not count toward paid seats. However, when a Guest user creates projects and namespaces, they are automatically promoted to a higher role than Guest and occupy a paid seat.

To prevent Guest users from being promoted to a higher role and occupying a paid seat, set the user as external.

External users cannot create personal projects or namespaces. If a user with the Guest role is promoted into a higher role by another user, the external user setting must be removed before they can create personal projects or namespaces. For a complete list of restrictions for external users, see External users.