§ How to · with Picoo
How to make an admin panel in Roblox Studio
By Sametcan Tasgiran, Founder & Developer·Published ·Updated
An admin panel is the one system where a tutorial that looks right can hand every exploiter in your server a ban button.
RemoteEvents are callable by anyone. A panel that only hides its buttons from non-admins is decoration, not security — the check has to live on the server.
Player list + target
Live list of everyone in the server; pick a target, then act on them.
Moderation
Kick and ban. Bans persist across servers via DataStore and are re-checked on join.
Movement
Bring a player to you, teleport to them, freeze/unfreeze, cycle walkspeed.
Combat/testing
Heal, kill, god mode — the toggles you actually need while testing a game.
Fly (self)
Applied on the client, because the client owns its character's physics — but only after the server confirms you are an admin.
Announce
Server-wide banner message to every player.
Files Picoo ships for this prompt
3 files · 392 lines · ~40s · 2 credit
AdminServer
The authority: admin list, ban DataStore, every command re-validated here.
215 lines
AdminPanel (ScreenGui)
41 instances built in Edit mode — restyle it without pressing Play.
41 lines
AdminClient
Opens the panel, renders the player list, applies fly after approval.
177 lines
Sample output: ServerScriptService.AdminServer
-- The check that actually matters. Everything below it is unreachable
-- for a non-admin, no matter what their client sends.
commandEvent.OnServerEvent:Connect(function(plr, command, targetName, extra)
if not isAdmin(plr) then
warn(("%s (%d) tried '%s' without admin rights"):format(plr.Name, plr.UserId, tostring(command)))
return
end
if typeof(command) ~= "string" then return end
if command == "kick" then
local target = Players:FindFirstChild(targetName)
if target then target:Kick("Kicked by " .. plr.Name) end
end
end)
-- The place owner is always an admin. For GROUP-owned games game.CreatorId is
-- the GROUP id, not a person, so it must not be treated as a UserId.
local OWNER_ID = game.CreatorType == Enum.CreatorType.User and game.CreatorId or 0Building an admin panel in Roblox Studio
Most admin-panel tutorials are a GUI and a RemoteEvent the server obeys. That is not an admin panel — it is a public API for kicking people. RemoteEvents can be fired by any client with any arguments, so the only check that means anything is the one that runs on the server, on every command, before it does anything.
Picoo's panel is built around that. The GUI is a convenience; ServerScriptService.AdminServer re-validates the caller against the admin list for kick, ban, freeze, heal, god, speed, kill, bring, goto and announce alike. A non-admin firing the remote gets a warn in the server log and no effect — not a partial effect, not a silent success.
Bans are written to a DataStore and re-checked on PlayerAdded, so they hold across servers and restarts rather than lasting until the next shutdown. The DataStore write is wrapped in pcall: a throttled SetAsync should not take the whole command down with it.
Fly is the one thing that runs on the client, and that is deliberate. Character physics is client-owned in Roblox — a server-side velocity write on someone else's character fights their own simulation and rubber-bands. So the server answers "yes, you are an admin", and the client performs the movement. Every damaging or destructive action stays on the server.
The panel itself lands in StarterGui as real instances in Edit mode, so you can recolour it, move it, or rip half of it out without pressing Play — and the commands stay wired.
See more on the Luau generator, the game builder, or browse the full blog.
Frequently asked
Why can't I just check the admin list on the client?+
Because the client is the attacker. Anything a LocalScript can decide, an exploiter can decide differently — they can fire your RemoteEvent directly with whatever arguments they like. Hiding the panel is fine as UX; the permission check has to run on the server, on every single command.
How do I add myself as an admin?+
The place owner is included automatically. For anyone else, pass usernames or UserIds. Prefer UserIds — usernames change, and a renamed account silently loses (or gains) access.
Do bans survive a server restart?+
Yes. Bans are written to a DataStore and re-checked on PlayerAdded, so a banned player is kicked on join in any server. Session-only banning is available if you would rather not persist.
Why is fly handled on the client?+
Character physics is client-owned in Roblox. Writing velocity from the server on someone else's character fights their own simulation and produces rubber-banding. The correct split is: the server decides you are ALLOWED to fly, the client performs it.
Does this work in a group game?+
Yes, but note that game.CreatorId is the GROUP id for group-owned places, not a person's UserId. Treating it as an owner id is a common bug — list your admins explicitly in that case.
Related Picoo prompts
How to prevent exploits in Roblox
4 files · 160 lines · 44 seconds · 1 credit. Drop-in guards + a one-prompt audit of your existing scripts.
How to use Roblox DataStore the right way
3 files · 140 lines · 36 seconds · 1 credit. Drop-in save service for any game.
Roblox currency system
4 files · 150 lines · 44 seconds · 1 credit. Cash + Gems + premium currency by default.