Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Playing with friends? Godlike.Host runs hosted Minecraft Java servers from 10 data-center locations, with free DDoS protection.
On a Minecraft Bedrock Dedicated Server, adding a sub-user involves two separate decisions: whether that player may connect and what the player may do after joining. The allowlist controls entry. Player permissions and operator status control in-game capabilities. Configure both controls, give each person the least powerful role that meets their needs, and test the result before handing over administrative access.
This guide covers the Bedrock Dedicated Server executable on Windows and Ubuntu Linux. Java Edition servers use different server software and, commonly, permission plugins, so the Bedrock commands below are not universal Java instructions.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
What “sub-user” means on a Minecraft server
Minecraft does not have one universal account type called a sub-user. In practice, the term usually means another player, family member, builder, moderator, or administrator who needs controlled access to your server.
Two controls must be kept distinct:
| Control | Question it answers | Typical Bedrock mechanism |
|---|---|---|
| Join access | May this Gamertag connect to the server? | allow-list=true, allowlist.json, and /allowlist |
| In-game permissions | What may a connected player do? | Member, Visitor, Custom, or Operator role and permission data |
Adding a player to the allowlist does not make that player a moderator. Conversely, giving someone a role does not automatically solve an allowlist rejection. Manage both layers whenever you onboard or remove a person.
#1 Best Overall
Check the edition and hosting arrangement first
Confirm that this procedure fits your server
The procedure here is for Minecraft: Bedrock Edition Dedicated Server. Bedrock Dedicated Server is distributed for supported Windows and Ubuntu Linux systems. A Java server may be vanilla, Paper, Fabric, or another implementation; its whitelist command, permissions model, and plugin configuration depend on that stack. Do not paste Bedrock commands into a Java console without checking the documentation for the exact server software.
Choose who will operate the server
Self-hosting gives you direct access to the executable, server.properties, allowlist.json, permission data, backups, and firewall rules. It also makes you responsible for updates, restarts, network exposure, and recovery. A management panel or managed service may provide forms for allowlists and roles, but the labels and available controls vary. Before delegating administration, establish who can change access, where backups are stored, whether changes are audited, and how to recover if a panel account is compromised.
Prepare a Bedrock Dedicated Server
- Download the Bedrock Dedicated Server package from the official Minecraft documentation and unpack it on a supported Windows or Ubuntu Linux machine.
- Start the server once so it creates its data files, then stop it cleanly before making configuration changes.
- Open
server.propertiesand review the access-related settings, includingonline-mode,allow-list,default-player-permission-level, andmax-players. - For an Internet-facing server, keep
online-mode=true. Online authentication helps ensure that a connecting identity is validated rather than accepted as an arbitrary name. - Configure the host firewall and any router forwarding required by your network. The Bedrock guide documents UDP ports 19132 and 19133 as the default server ports; use the port assigned in your own configuration and expose only what is necessary.
- Start the server again and confirm that it reaches a ready state before adding players.
Keep a copy of the server directory before changing access files. A backup lets you restore the previous allowlist or permission state if a malformed edit or mistaken revocation locks everyone out.
Turn on the allowlist and add a player
Enable connection restriction
Stop the server or edit its configuration while it is not writing the file, then set this property in server.properties:
allow-list=trueWith this setting enabled, only players represented in allowlist.json may connect. A player who is not listed will be refused even if the server has capacity.
Use the console commands
The Bedrock console accepts the following commands. In chat, an initial slash is customary; in a server console, use the command form accepted by that console.
/allowlist add <GamerTag>
/allowlist list
/allowlist remove <GamerTag>
/allowlist reloadaddcreates an allowlist entry for the specified Gamertag.listdisplays the current entries so you can check spelling and membership.removedeletes a player’s join permission.reloadmakes the running server reread allowlist data after an external edit.
/whitelist is documented as an alias for the allowlist command. Use one naming convention consistently in your operating notes so helpers know which command to run.
Edit allowlist.json only when you can reload safely
The Bedrock server stores allowlist entries in allowlist.json. The documented entry fields include name, an optional xuid, and ignoresPlayerLimit. The latter is a capacity-related exception, not a permission role: it does not grant building, command, or operator powers.
If you edit the JSON file outside Minecraft, preserve valid JSON syntax and run /allowlist reload. Without the reload, the running process may continue using the old list. Prefer the console command for routine additions because it avoids spelling, punctuation, and file-locking errors.
Give each sub-user the smallest useful role
Bedrock provides four broad permission choices. Select the role according to the actions the person must perform, not according to their relationship to you.
Recommended Free Tools
| Role | Use it for | Access implication |
|---|---|---|
| Visitor | Someone who should observe or move around with very limited interaction | Restrictive; suitable for spectators or guests |
| Member | Ordinary players who need normal gameplay | Standard play without server administration |
| Custom | A helper whose abilities do not fit the standard roles | Choose individual capabilities such as building, mining, containers, combat, or commands |
| Operator | A trusted administrator who must run server commands | Powerful administrative access; use sparingly |
Use Member for normal players
Member is the usual starting point for a friend or family member who needs to play, build, mine, use doors and switches, open containers, and interact with mobs within ordinary gameplay rules. It avoids giving that player server-level command authority.
Use Visitor for observation
Visitor is appropriate when someone should be able to join and look around but should not receive ordinary building or interaction privileges. Verify the exact behavior in your world settings and server version before relying on it for a special event.
Use Custom for a narrowly defined helper job
Custom permissions are useful for roles such as a builder, event moderator, or trusted playtester. The documented controls can distinguish actions including:
- Building and mining
- Using doors and switches
- Opening containers
- Attacking players or mobs
- Running operator commands
Grant only the controls required by the task. For example, a helper who needs to inspect storage does not necessarily need combat permissions, and a builder does not necessarily need operator commands. Test each selected capability with a test account or with the helper present before treating the role as finished.
Rank #3
- The classic UNO card game builds fun on game night with a Minecraft theme.
- UNO Minecraft features a deck and storage tin decorated with graphics from the popular video game.
- Players match colors and numbers to the card on top of the discard pile as in the classic game.
- The Creeper card unique to this deck forces other players to draw 3 cards.
- Makes a great gift for kid, teen, adult and family game nights with 2 to 10 players ages 7 years and older, especially Minecraft and video game fans.
Reserve Operator for administrators
Operator status is a recovery and administration capability, not a convenience badge. An operator can run powerful commands that affect players, worlds, and server state. Give it only to people you trust with the whole server, and keep at least one trusted operator account available for recovery.
Grant and revoke operator access
From the Bedrock server console, use:
op <playername>
deop <playername>op grants operator privileges to the named player. deop removes them. Check the exact spelling and identity before executing either command; a mistaken name can grant access to the wrong person or leave the intended administrator unable to help.
The dedicated-server /permission reference also documents commands for listing and reloading permission data:
/permission list
/permission reloadUse /permission reload after changing permission data outside the running server. The precise syntax for setting a custom permission depends on the permission-file format and server version, so do not invent a role command from a Java plugin guide. Keep a written record of which controls each custom role is intended to provide.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Verify a new sub-user before handing over access
- Confirm that the person’s exact Gamertag appears in
/allowlist list. - Have the person connect while the allowlist is enabled. This catches name, authentication, and network problems that a file check cannot.
- Ask the person to perform each intended action: for example, place a block, mine, use a switch, open a container, or run the specific command they were assigned.
- Ask them to attempt one administrative action they should not have. A failed attempt is evidence that least privilege is working; do not test destructive commands in a valuable world.
- Check the server console for errors and confirm that the role or operator change remains after a restart if persistence is required.
If a user can join but cannot perform a task, the problem is usually the role or custom capability, not the allowlist. If the user cannot join at all, check allow-list, the exact Gamertag, authentication mode, network port, and whether an external allowlist edit was followed by /allowlist reload.
Remove a sub-user cleanly
When a player leaves the community or no longer needs elevated access, revoke both kinds of access that may apply:
- Run
deop <playername>if the player is an operator. - Run
/allowlist remove <GamerTag>to prevent future connections to an allowlisted server. - If you maintain custom permission data, remove or change the related entry, then run
/permission reload. - Run
/allowlist listand, where appropriate,/permission listto verify the result. - Record the change and retain a backup of the previous files according to your server’s recovery policy.
Removing an allowlist entry controls future joins; it does not by itself undo operator status. That is why de-op and allowlist removal are separate steps.
Rank #4
- Now Minecraft lovers can play a special version of UNO!
- Same as Basic UNO but features Minecraft characters and includes special Creeper rule card. Draw this card and the other players have to draw three more cards from the pile!
- The goal is to get rid of all the cards in your hand.
- First player or team to 500 wins.
- When you're down to one card, don't forget to yell "UNO"!
Understand the files behind the controls
server.properties
This file contains server-wide settings relevant to sub-user management, including:
allow-list: whether only listed players may connect.default-player-permission-level: the default permission level assigned to players when no more specific arrangement applies.online-mode: whether connecting identities are authenticated.max-players: the configured player capacity.
Many settings are read at startup. Make a change when the server is stopped if the documentation for that property requires it, then restart and confirm the resulting value.
allowlist.json
This file represents who may connect when the allowlist is enabled. Entries can include a name, optional XUID, and the ignoresPlayerLimit field. Do not treat an allowlist entry as proof that a person has moderator privileges; role and operator data are separate.
Reload versus restart
Use /allowlist reload for allowlist changes and /permission reload for permission data when those files are edited while the server is running. A panel may still require a restart for other property changes. Follow the panel’s warning rather than assuming every form applies instantly.
Console, files, panel, or managed hosting?
The right administration method depends on who operates the server and how much direct control they need.
| Administration method | Strengths | Costs and risks | Check before choosing |
|---|---|---|---|
| Server console | Direct, auditable commands; fast allowlist and operator changes | Requires access to the host and command knowledge | Who can access the console and how console logs are protected |
| Direct file editing | Full control over server.properties, allowlist.json, and permission data |
JSON or property syntax mistakes can prevent correct loading | Backups, safe shutdown procedure, and reload or restart requirements |
| Web management panel | Forms can simplify allowlists, roles, restarts, and delegation | Labels, role granularity, audit history, and restart behavior differ by panel | Bedrock support, custom permissions, backups, audit logs, and account security |
| Managed hosting | Less work for operating systems, firewall rules, updates, and uptime | Less direct control and provider-specific recovery procedures | Exact Bedrock version support, data export, access revocation, and support boundaries |
Regardless of the interface, evaluate five things: control of the underlying files, operational burden, permission granularity, recovery and audit capability, and edition support. A panel that offers an “admin” checkbox may not provide the same custom build, container, combat, and command controls available in Bedrock’s permission model.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common access problems
“The player is not allowed to join”
- Confirm
allow-list=trueis intentional. - Run
/allowlist listand compare the entry with the player’s exact Gamertag. - If you edited
allowlist.json, run/allowlist reload. - Check that the player is connecting to the correct address and UDP port, and that the firewall or router permits that port.
- Keep
online-mode=truefor an Internet-facing server unless you have a specific, documented reason to change it.
“The player can join but cannot build or open containers”
The allowlist is working; review the assigned role and custom capabilities. Member may be sufficient for ordinary play, while Visitor is intentionally restrictive. If the player has a custom role, verify each required control rather than granting Operator as a shortcut.
“The user still has administrative power”
Run deop <playername>, review custom permission data, and run /permission reload if you changed that data externally. Also check whether a panel has its own administrator account that is separate from the in-game role.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match“A file change did nothing”
Check whether the server was running during the edit, whether the JSON remains valid, and whether the relevant reload command was run. Some server.properties changes require a restart rather than a reload. Restore the last known-good backup if the server begins reporting configuration errors.
Security practices for shared administration
- Use least privilege: Member for normal players, Custom for narrowly scoped helpers, and Operator only for full administrators.
- Keep online authentication enabled on public servers.
- Back up the world, allowlist, permission data, and key configuration before changing access.
- Separate the person who needs to build from the person who needs to run server commands.
- Review the allowlist and operator list periodically, especially after an event or staff change.
- Document who may change access and how to recover an account or restore files.
- Protect console, panel, and host credentials as carefully as the operator role itself.
Bedrock commands at a glance
| Goal | Command | When to use |
|---|---|---|
| Add join access | /allowlist add <GamerTag> |
Permit a named player while the allowlist is enabled |
| Review join access | /allowlist list |
Check current entries |
| Remove join access | /allowlist remove <GamerTag> |
Prevent future allowlisted connections |
| Apply allowlist file edits | /allowlist reload |
After editing allowlist.json externally |
| Grant full in-game administration | op <playername> |
Only for trusted administrators |
| Revoke full in-game administration | deop <playername> |
Immediately remove operator status |
| Review permission data | /permission list |
Inspect permissions supported by the dedicated server |
| Apply permission-file edits | /permission reload |
After changing permission data externally |
Frequently Asked Questions
Does adding someone to the Bedrock allowlist make them an operator?
No. The allowlist controls whether the Gamertag may connect. Operator status must be granted separately with op <playername>, and ordinary players should normally receive Member or a narrowly scoped Custom role instead.
Can I use these commands on a Minecraft Java server?
Not as a universal procedure. Java servers use different implementations and may rely on plugins, so check the documentation for the exact vanilla, Paper, Fabric, or other server stack you run.
What should I do if I accidentally remove every administrator?
Use your host’s console or recovery access rather than trying to solve the problem from an ordinary player account. Restore a known-good permission or configuration backup, then verify the allowlist and operator entries before reconnecting players.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is ignoresPlayerLimit a moderator permission?
No. It is an allowlist entry field related to the player-capacity limit. It does not grant building rights, custom capabilities, or operator commands.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
