The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →On a Minecraft Bedrock Dedicated Server, adding a sub-user requires two separate decisions: whether the player may connect at all, and what that connected player may do. Enable the server allowlist to control entry, then assign the least-powerful role that supports the job—usually Member, Visitor, or a narrowly configured Custom role. Reserve Operator for trusted administrators.
Playing with friends? Godlike.Host runs hosted Minecraft Java servers from 10 data-center locations, with free DDoS protection.
This guide covers the official Bedrock Dedicated Server workflow on Windows and Ubuntu Linux, including console commands, configuration files, verification, removal, recovery, and the limits of applying these instructions to Java Edition.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat “sub-user” means on a Minecraft server
Minecraft does not use one universal “sub-user” account type on a self-hosted server. In practical administration, a sub-user is another person—player, family member, moderator, builder, or helper—whose ability to join and act in the world you control.
Bedrock Dedicated Server separates that control into two layers:
#1 Best Overall
- Join access: the allowlist determines which Gamertags may connect when
allow-list=true. - In-game authority: the player permission level determines what a connected person can do, from ordinary play to administrative commands.
A player can be on the allowlist and still have no administrative authority. Conversely, giving someone operator privileges does not by itself decide whether an allowlist-enabled server will accept that person; the Gamertag still needs to be allowed. Treat these as separate controls whenever you add, change, or remove a user.
Choose the right hosting boundary first
The procedure below assumes Minecraft: Bedrock Edition Dedicated Server, not a Realm and not a console-hosted local world. You run the Bedrock server executable, its world files, and its configuration on a supported Windows or Ubuntu Linux machine.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Self-hosted Bedrock server
Self-hosting gives you direct access to server.properties, allowlist.json, permission data, backups, and the server console. You are also responsible for downloading updates, keeping the operating system secure, configuring the firewall and router, preserving backups, and restarting the process when required.
Web panel or managed service
A management panel may present allowlist and permission controls as buttons instead of files and console commands. That can reduce operational work, but the panel is still an interface over the underlying Bedrock settings. Confirm which Bedrock version it supports, whether it can express Custom permissions, how it records changes, and how you restore a previous configuration. A panel that only offers “op” and “deop” is less granular than one that exposes Member, Visitor, and individual Custom capabilities.
| Decision area | Console and files | Web panel or managed service |
|---|---|---|
| Control | Direct editing of server.properties, allowlist.json, and permission data |
Depends on the panel’s exposed controls and its access to those files |
| Operational burden | You handle executable updates, firewall rules, backups, and restarts | The provider may simplify these tasks, but policies and restart behavior vary |
| Granularity | Can use Bedrock’s built-in roles and Custom controls | Only as granular as the panel implementation |
| Recovery and audit | You must create backups and track console or file changes | Look for snapshots, audit logs, and a safe rollback process |
| Edition support | Explicitly choose Bedrock Dedicated Server | Verify the exact edition and server software; Java and Bedrock controls are not interchangeable |
Prepare a Bedrock Dedicated Server safely
Download and unpack the current Bedrock Dedicated Server package for your operating system, then start it once so the default files and world are created. The official setup supports Windows and Ubuntu Linux. For an Internet-facing server, keep online-mode=true; this makes the server use authenticated accounts rather than accepting arbitrary names.
Network and firewall prerequisites
Bedrock Dedicated Server uses UDP. The documented default ports are UDP 19132 for the primary server and UDP 19133 for an additional IPv6-oriented configuration. Open only the port you actually use in the host firewall and, if the server is behind a router, forward that UDP port to the server’s private address. Test from outside the local network rather than assuming that a successful local connection proves the forwarding is correct.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Give the server machine a stable private IP address or a DHCP reservation.
- Allow the selected UDP port through the operating-system firewall.
- Forward the same UDP port on the router if outside players must connect.
- Keep the server executable and operating system patched.
- Back up the world and configuration before changing access.
Do not disable authentication merely to make a connection problem disappear. Fix the network path, account sign-in, or client-version mismatch instead.
Turn on the allowlist before adding people
Stop the server or edit its configuration only when you can safely restart it, then open server.properties. Set:
allow-list=trueThis setting restricts connections to players listed in allowlist.json. The same file also contains each entry’s name, an optional xuid, and an ignoresPlayerLimit value. Preserve valid JSON syntax; a missing comma or quote can prevent the file from loading correctly.
Add and inspect entries from the console
With the server running, use the console commands below. In a game chat window, commands normally have a leading slash; the dedicated-server console accepts the command form shown here.
allowlist add <GamerTag>— add the player’s exact Gamertag.allowlist list— display the entries currently known to the server.allowlist reload— reread the allowlist data after an external file edit.
whitelist is documented as an alias for allowlist, but using the canonical command makes scripts and support notes clearer. Match capitalization and spelling to the player’s actual Microsoft/Xbox Gamertag; do not substitute a nickname used only in your community chat.
Editing allowlist.json directly
Direct editing is useful for bulk changes or automated backups, but it creates a stale-data risk: the running process may still hold the previous list in memory. After saving a valid file, run allowlist reload. If a reload reports an error, stop changing access, restore the last known-good backup, and reload again rather than repeatedly editing a malformed file.
Assign the least-powerful useful role
Allowlist membership answers “may this player connect?” A permission role answers “what may this player do after connecting?” Bedrock roles include Operator, Member, Visitor, and Custom.
Member for ordinary players
Member is the normal starting point for a player who should build, mine, interact with the world, and play without administrative command access. Use it for friends, family, and community members who do not need to manage other users or server settings.
Recommended Free Tools
Visitor for observation
Visitor is appropriate when someone should look around without receiving normal building and world-interaction abilities. It can be useful for tours, spectators, or a new participant whose access you are validating before granting a more active role.
Custom for a narrowly defined helper job
Custom is the least-privilege option when Member grants too much but Visitor grants too little. Bedrock’s documented Custom controls can cover building, mining, using doors and switches, opening containers, attacking players or mobs, and using operator commands. Enable only the capabilities the person needs. For example, a tour guide may need movement and doors but not container access; a builder may need building and mining but not attacking players; a moderator who must run commands may require operator-command capability, which should be treated as highly sensitive.
Rank #3
- The classic UNO card game builds fun on game night with a Minecraft theme.
- UNO Minecraft features a deck and storage tin decorated with graphics from the popular video game.
- Players match colors and numbers to the card on top of the discard pile as in the classic game.
- The Creeper card unique to this deck forces other players to draw 3 cards.
- Makes a great gift for kid, teen, adult and family game nights with 2 to 10 players ages 7 years and older, especially Minecraft and video game fans.
Operator only for trusted administrators
Operator is powerful. It can expose administrative commands that affect the world, users, and server state. Grant it only to people who can be trusted with full administrative consequences, and keep the number of operators small. Record who has it and why.
Grant and revoke operator status
The Bedrock console provides two direct commands:
op <playername>
deop <playername>op grants operator privileges to the named player. deop revokes them. Use the exact in-game name and verify the result with the affected player while you are still connected to the console. Do not grant operator status as a shortcut for a missing Custom permission; first determine whether a narrower role meets the requirement.
Free tools Windows power users keep installed
One-click scans. No signup required.
For permission-file workflows, the dedicated-server /permission command reference documents list and reload, and describes a set form in its syntax. Because the exact file format and available values depend on the Bedrock build and management interface, make a backup and follow the command syntax for the version you are running rather than pasting an unverified Java permissions command.
Use a repeatable add-user procedure
For each new person, follow the same sequence so that a forgotten reload or accidental operator grant does not become an access incident.
- Confirm identity. Ask for the player’s exact Gamertag as displayed by the Bedrock client.
- Back up access data. Copy
allowlist.json, permission data, and the relevant world backup to a dated location. - Add join access. Run
allowlist add <GamerTag>or add a valid JSON entry toallowlist.json. - Reload external changes. If you edited a file, run
allowlist reload. - Select a role. Start with Member, Visitor, or a minimal Custom set. Do not begin with Operator “just to test.”
- Apply permission changes. Use the server’s documented permission mechanism or panel, then run
permission reloadwhen the change was made in permission data outside the running process. - Test with the user online. Have the player perform each required action and one action that should be blocked.
- Record the result. Note the Gamertag, role, date, reason, and administrator who made the change.
Verify what the sub-user can actually do
Do not infer effective access from a role label alone, especially after changing a Custom profile. Test in a safe area or a copy of the world.
- Can the user connect while the allowlist is enabled?
- Can they perform the intended building, mining, interaction, container, or combat actions?
- Are actions outside the assignment blocked?
- Can they run administrative commands? If not, confirm that command attempts fail as expected.
- Can an ordinary Member or Visitor affect protected areas or other players?
- Does a reconnect preserve the same result?
Test after a restart as well as immediately after a reload. A setting that appears correct in memory but is not saved to the right file will disappear on the next process start.
Remove a user and close every access path
When someone leaves the server, remove connection access and elevated authority separately. Run:
allowlist remove <GamerTag>
deop <playername>Use deop if the person ever had operator status, even if you believe removing the allowlist entry is sufficient. If you edited the allowlist file, run allowlist reload. If you changed permission data, run permission reload. Then test that the account is refused a new connection and that any existing session has ended according to your server’s behavior.
Rank #4
- Now Minecraft lovers can play a special version of UNO!
- Same as Basic UNO but features Minecraft characters and includes special Creeper rule card. Draw this card and the other players have to draw three more cards from the pile!
- The goal is to get rid of all the cards in your hand.
- First player or team to 500 wins.
- When you're down to one card, don't forget to yell "UNO"!
For a temporary suspension, preserve the person’s prior role in your change log, remove them from the allowlist, and restore access only after reviewing the reason. Do not delete backups while an access dispute is unresolved.
Understand the key server.properties settings
The following properties directly affect sub-user administration:
| Property | Purpose | Administrative implication |
|---|---|---|
allow-list |
Enables restriction to entries in allowlist.json |
Set to true when you need controlled join access |
default-player-permission-level |
Sets the default permission level for newly joining players | Choose a conservative default, then assign exceptions deliberately |
online-mode |
Controls authenticated account access | Keep enabled for an Internet-facing server |
max-players |
Sets the player capacity | Changing capacity does not replace allowlist or role management |
Changing a property may require a restart, depending on the setting and management interface. Make one related change at a time, keep a backup, and confirm the effective value after the server starts.
Panel-based administration: what to check
A panel can expose separate Access Control/Allowlist and Permissions pages. Treat those as two workflows, not one combined “add user” button. Confirm that the panel lets you:
- Search and remove exact Gamertags.
- Assign Member, Visitor, Operator, or Custom capabilities rather than only a global operator switch.
- Reload data without silently overwriting manual changes.
- See who changed access and when.
- Back up and restore
allowlist.json, permission data, and worlds. - Understand which edits require a restart.
Before delegating administration, create a non-operator test account and verify that the panel’s labels match actual in-game behavior. A panel that reports “moderator” may simply be granting Operator; inspect the resulting permission level rather than trusting the marketing label.
Troubleshoot common sub-user problems
The player is denied even though you added them
- Check that
allow-list=trueis the active setting and that the Gamertag is spelled exactly. - Run
allowlist listto see what the server currently has loaded. - If you edited JSON, run
allowlist reloador restart after restoring valid syntax. - Confirm the player is signing into the expected Microsoft/Xbox account.
- Check that the client is connecting to the correct server address and port.
The player can join but cannot perform the assigned task
Check the effective role, not only the allowlist. Visitor intentionally blocks many normal interactions. A Custom role may omit a required capability such as building, mining, containers, doors and switches, or attacking. Add only the missing capability, reload permission data when applicable, and retest after reconnecting.
The helper can do far more than intended
Immediately run deop <playername> if the person is an operator, then assign a narrower role. Review the Custom capability list and remove operator-command access unless it is essential. Preserve the current configuration before editing so you can identify which change caused the excess access.
A file edit appears to have no effect
The running server may still be using cached data. Use allowlist reload for allowlist edits and permission reload for permission data. If the panel or server reports that a property requires a restart, schedule a controlled restart and verify the setting afterward.
A restart erased the change
The edit may have been made to a different server directory, a temporary panel copy, or invalid JSON that was discarded. Stop the correct instance, identify its active working directory, restore the dated backup, make the change once, and confirm it survives a clean restart.
Keep an administrative recovery path
Access management can lock out even the owner if every operator is removed or a malformed file prevents normal startup. Keep a local or offline copy of the latest known-good server.properties, allowlist.json, permission data, and world backup. Restrict filesystem access to trusted administrators, and do not store those backups in a location that every sub-user can modify.
Document at least one recovery method that does not depend on the user you are trying to revoke: direct console access, a secured server terminal, or a panel owner account. Test restoration on a copy of the server before an emergency. Never give a helper your personal operating-system or panel-owner credentials merely because they need an in-game role.
Why Bedrock commands should not be copied to Java
The instructions in this article are for Bedrock Dedicated Server. Java Edition can run vanilla, Paper, Fabric, or another implementation, often with a permissions plugin. Its allowlist commands, operator levels, permission nodes, file formats, and panel integrations can differ substantially. There is no single universal Java “sub-user” procedure that can be safely substituted here.
For a Java server, first identify the exact server software and plugin stack, then use documentation for that implementation. Do not paste Bedrock’s allowlist, permission reload, or Custom-role assumptions into a Java console without verifying that the command exists and has the same meaning.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical least-privilege policy
For a small private server, the following policy is easy to maintain:
- Everyone who may connect is listed explicitly in the allowlist.
- New players start as Member or Visitor, never Operator.
- Helpers receive a Custom profile tailored to one job.
- Only a very small number of trusted owners are operators.
- Every grant, change, and removal is dated and attributable.
- Allowlist and permission files are backed up before edits.
- Reloads and restarts are followed by a real behavior test.
- Departing users are removed from the allowlist and deopped in the same maintenance task.
This approach makes “add another user” a controlled, reversible process rather than a permanent handover of server control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
