Talking Drupal #097 - Blocking Unwanted Users

RoleAssign specifically allows site administrators to further delegate the task of managing user's roles while withholding the Administer permissions permission.

RoleAssign introduces a new permission called Assign roles. Users with this permission are able to assign selected roles to still other users. Only users with the Administer permissions permission may select which roles are available for assignment through this module.

RoleAssign is ideal for smaller sites with a system administrator and one assistant administrator role that should be reasonably restricted in what it allows. For larger sites with multiple levels of administrators or whenever you need finer-grained control over which role can assign which other role, check out Role Delegation. See #961682: Does the role delegation module supersede this module? for a short discussion of the relative merits of the two modules.