diff --git a/src/com/android/settings/DimmableIconPreference.java b/src/com/android/settings/DimmableIconPreference.java
index 57cdc8d..98bf551 100644
--- a/src/com/android/settings/DimmableIconPreference.java
+++ b/src/com/android/settings/DimmableIconPreference.java
@@ -25,16 +25,22 @@
 import android.util.AttributeSet;
 import android.widget.TextView;
 
+import com.android.settingslib.RestrictedPreference;
+
 /**
  * A preference item that can dim the icon when it's disabled, either directly or because its parent
  * is disabled.
  */
-public class DimmableIconPreference extends Preference {
+public class DimmableIconPreference extends RestrictedPreference {
     private static final int ICON_ALPHA_ENABLED = 255;
     private static final int ICON_ALPHA_DISABLED = 102;
 
     private final CharSequence mContentDescription;
 
+    public DimmableIconPreference(Context context) {
+        this(context, (AttributeSet) null);
+    }
+
     public DimmableIconPreference(Context context, AttributeSet attrs) {
         super(context, attrs);
         mContentDescription = null;
@@ -54,23 +60,12 @@
     }
 
     @Override
-    public void onParentChanged(Preference parent, boolean disableChild) {
-        dimIcon(disableChild);
-        super.onParentChanged(parent, disableChild);
-    }
-
-    @Override
-    public void setEnabled(boolean enabled) {
-        dimIcon(!enabled);
-        super.setEnabled(enabled);
-    }
-
-    @Override
     public void onBindViewHolder(PreferenceViewHolder view) {
         super.onBindViewHolder(view);
         if (!TextUtils.isEmpty(mContentDescription)) {
             final TextView titleView = (TextView) view.findViewById(android.R.id.title);
             titleView.setContentDescription(mContentDescription);
         }
+        dimIcon(!isEnabled());
     }
 }
diff --git a/src/com/android/settings/PrivacySettings.java b/src/com/android/settings/PrivacySettings.java
index 0735b11..dbceb2b 100644
--- a/src/com/android/settings/PrivacySettings.java
+++ b/src/com/android/settings/PrivacySettings.java
@@ -38,6 +38,7 @@
 import com.android.settings.dashboard.SummaryLoader;
 import com.android.settings.search.BaseSearchIndexProvider;
 import com.android.settings.search.Indexable;
+import com.android.settingslib.RestrictedPreference;
 
 import java.util.ArrayList;
 import java.util.Collection;
@@ -167,6 +168,12 @@
         mConfigure.setEnabled(configureEnabled);
         mConfigure.setIntent(configIntent);
         setConfigureSummary(configSummary);
+
+        RestrictedPreference networkResetPref = (RestrictedPreference) findPreference(
+                NETWORK_RESET);
+        if (networkResetPref != null) {
+            networkResetPref.checkRestrictionAndSetDisabled(UserManager.DISALLOW_NETWORK_RESET);
+        }
     }
 
     private void setConfigureSummary(String summary) {
@@ -290,9 +297,5 @@
             nonVisibleKeys.add(AUTO_RESTORE);
             nonVisibleKeys.add(CONFIGURE_ACCOUNT);
         }
-        if (UserManager.get(context).hasUserRestriction(
-                UserManager.DISALLOW_NETWORK_RESET)) {
-            nonVisibleKeys.add(NETWORK_RESET);
-        }
     }
 }
diff --git a/src/com/android/settings/SeekBarPreference.java b/src/com/android/settings/SeekBarPreference.java
index f225967..ef28ed7 100644
--- a/src/com/android/settings/SeekBarPreference.java
+++ b/src/com/android/settings/SeekBarPreference.java
@@ -28,10 +28,12 @@
 import android.widget.SeekBar;
 import android.widget.SeekBar.OnSeekBarChangeListener;
 
+import com.android.settingslib.RestrictedPreference;
+
 /**
  * Based on android.preference.SeekBarPreference, but uses support preference as base.
  */
-public class SeekBarPreference extends Preference
+public class SeekBarPreference extends RestrictedPreference
         implements OnSeekBarChangeListener, View.OnKeyListener {
 
     private int mProgress;
diff --git a/src/com/android/settings/WirelessSettings.java b/src/com/android/settings/WirelessSettings.java
index f5a9dec..63455d8 100644
--- a/src/com/android/settings/WirelessSettings.java
+++ b/src/com/android/settings/WirelessSettings.java
@@ -51,6 +51,7 @@
 import com.android.settings.nfc.NfcEnabler;
 import com.android.settings.search.BaseSearchIndexProvider;
 import com.android.settings.search.Indexable;
+import com.android.settingslib.RestrictedPreference;
 
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -226,7 +227,8 @@
         final Activity activity = getActivity();
         mAirplaneModePreference = (SwitchPreference) findPreference(KEY_TOGGLE_AIRPLANE);
         SwitchPreference nfc = (SwitchPreference) findPreference(KEY_TOGGLE_NFC);
-        PreferenceScreen androidBeam = (PreferenceScreen) findPreference(KEY_ANDROID_BEAM_SETTINGS);
+        RestrictedPreference androidBeam = (RestrictedPreference) findPreference(
+                KEY_ANDROID_BEAM_SETTINGS);
 
         mAirplaneModeEnabler = new AirplaneModeEnabler(activity, mAirplaneModePreference);
         mNfcEnabler = new NfcEnabler(activity, nfc, androidBeam);
@@ -258,7 +260,7 @@
         }
         // Disable VPN.
         // TODO: http://b/23693383
-        if (!isAdmin || mUm.hasUserRestriction(UserManager.DISALLOW_CONFIG_VPN)) {
+        if (!isAdmin) {
             removePreference(KEY_VPN_SETTINGS);
         }
 
@@ -315,10 +317,10 @@
         // Disable Tethering if it's not allowed or if it's a wifi-only device
         final ConnectivityManager cm =
                 (ConnectivityManager) activity.getSystemService(Context.CONNECTIVITY_SERVICE);
-        if (!isAdmin || !cm.isTetheringSupported()
-                || mUm.hasUserRestriction(UserManager.DISALLOW_CONFIG_TETHERING)) {
+
+        if (!isAdmin || !cm.isTetheringSupported()) {
             getPreferenceScreen().removePreference(findPreference(KEY_TETHER_SETTINGS));
-        } else {
+        } else if (!mUm.hasUserRestriction(UserManager.DISALLOW_CONFIG_TETHERING)) {
             Preference p = findPreference(KEY_TETHER_SETTINGS);
             p.setTitle(com.android.settingslib.Utils.getTetheringLabel(cm));
 
@@ -347,6 +349,19 @@
         } else {
             removePreference(KEY_WFC_SETTINGS);
         }
+
+        RestrictedPreference tetherSettingsPref = (RestrictedPreference) findPreference(
+                KEY_TETHER_SETTINGS);
+        if (tetherSettingsPref != null) {
+            tetherSettingsPref.checkRestrictionAndSetDisabled(
+                    UserManager.DISALLOW_CONFIG_TETHERING);
+        }
+
+        RestrictedPreference vpnSettingsPref = (RestrictedPreference) findPreference(
+                KEY_VPN_SETTINGS);
+        if (vpnSettingsPref != null) {
+            vpnSettingsPref.checkRestrictionAndSetDisabled(UserManager.DISALLOW_CONFIG_VPN);
+        }
     }
 
     @Override
diff --git a/src/com/android/settings/accounts/AccountSettings.java b/src/com/android/settings/accounts/AccountSettings.java
index 4296689..c8e0322 100644
--- a/src/com/android/settings/accounts/AccountSettings.java
+++ b/src/com/android/settings/accounts/AccountSettings.java
@@ -53,6 +53,7 @@
 
 import com.android.internal.logging.MetricsLogger;
 import com.android.settings.AccessiblePreferenceCategory;
+import com.android.settings.DimmableIconPreference;
 import com.android.settings.R;
 import com.android.settings.SettingsPreferenceFragment;
 import com.android.settings.Utils;
@@ -113,7 +114,7 @@
         /**
          * The preference that displays the add account button.
          */
-        public Preference addAccountPreference;
+        public DimmableIconPreference addAccountPreference;
         /**
          * The preference that displays the button to toggle work profile.
          */
@@ -324,17 +325,17 @@
         if (userInfo.isEnabled()) {
             profileData.authenticatorHelper = new AuthenticatorHelper(context,
                     userInfo.getUserHandle(), this);
-            if (!mUm.hasUserRestriction(DISALLOW_MODIFY_ACCOUNTS, userInfo.getUserHandle())) {
-                profileData.addAccountPreference = newAddAccountPreference(context);
-            }
+            profileData.addAccountPreference = newAddAccountPreference(context);
+            profileData.addAccountPreference.checkRestrictionAndSetDisabled(
+                    DISALLOW_MODIFY_ACCOUNTS, userInfo.id);
         }
         mProfiles.put(userInfo.id, profileData);
         Index.getInstance(getActivity()).updateFromClassNameResource(
                 AccountSettings.class.getName(), true, true);
     }
 
-    private Preference newAddAccountPreference(Context context) {
-        Preference preference = new Preference(getPrefContext());
+    private DimmableIconPreference newAddAccountPreference(Context context) {
+        DimmableIconPreference preference = new DimmableIconPreference(getPrefContext());
         preference.setTitle(R.string.add_account_label);
         preference.setIcon(R.drawable.ic_menu_add);
         preference.setOnPreferenceClickListener(this);
@@ -714,16 +715,13 @@
             for (int i = 0; i < profilesCount; i++) {
                 UserInfo userInfo = profiles.get(i);
                 if (userInfo.isEnabled()) {
-                    if (!um.hasUserRestriction(
-                            DISALLOW_MODIFY_ACCOUNTS, userInfo.getUserHandle())) {
-                        SearchIndexableRaw data = new SearchIndexableRaw(context);
-                        data = new SearchIndexableRaw(context);
-                        data.title = res.getString(R.string.add_account_label);
-                        data.screenTitle = screenTitle;
-                        result.add(data);
-                    }
+                    SearchIndexableRaw data = new SearchIndexableRaw(context);
+                    data = new SearchIndexableRaw(context);
+                    data.title = res.getString(R.string.add_account_label);
+                    data.screenTitle = screenTitle;
+                    result.add(data);
                     if (userInfo.isManagedProfile()) {
-                        SearchIndexableRaw data = new SearchIndexableRaw(context);
+                        data = new SearchIndexableRaw(context);
                         data = new SearchIndexableRaw(context);
                         data.title = res.getString(R.string.remove_managed_profile_label);
                         data.screenTitle = screenTitle;
diff --git a/src/com/android/settings/nfc/NfcEnabler.java b/src/com/android/settings/nfc/NfcEnabler.java
index c58c325..b81d342 100644
--- a/src/com/android/settings/nfc/NfcEnabler.java
+++ b/src/com/android/settings/nfc/NfcEnabler.java
@@ -27,6 +27,7 @@
 import android.support.v7.preference.PreferenceScreen;
 
 import com.android.settings.R;
+import com.android.settingslib.RestrictedPreference;
 
 /**
  * NfcEnabler is a helper to manage the Nfc on/off checkbox preference. It is
@@ -36,10 +37,9 @@
 public class NfcEnabler implements Preference.OnPreferenceChangeListener {
     private final Context mContext;
     private final SwitchPreference mSwitch;
-    private final PreferenceScreen mAndroidBeam;
+    private final RestrictedPreference mAndroidBeam;
     private final NfcAdapter mNfcAdapter;
     private final IntentFilter mIntentFilter;
-    private boolean mBeamDisallowed;
 
     private final BroadcastReceiver mReceiver = new BroadcastReceiver() {
         @Override
@@ -53,13 +53,11 @@
     };
 
     public NfcEnabler(Context context, SwitchPreference switchPreference,
-            PreferenceScreen androidBeam) {
+            RestrictedPreference androidBeam) {
         mContext = context;
         mSwitch = switchPreference;
         mAndroidBeam = androidBeam;
         mNfcAdapter = NfcAdapter.getDefaultAdapter(context);
-        mBeamDisallowed = ((UserManager) mContext.getSystemService(Context.USER_SERVICE))
-                .hasUserRestriction(UserManager.DISALLOW_OUTGOING_BEAM);
 
         if (mNfcAdapter == null) {
             // NFC is not supported
@@ -68,9 +66,6 @@
             mIntentFilter = null;
             return;
         }
-        if (mBeamDisallowed) {
-            mAndroidBeam.setEnabled(false);
-        }
         mIntentFilter = new IntentFilter(NfcAdapter.ACTION_ADAPTER_STATE_CHANGED);
     }
 
@@ -117,8 +112,8 @@
         case NfcAdapter.STATE_ON:
             mSwitch.setChecked(true);
             mSwitch.setEnabled(true);
-            mAndroidBeam.setEnabled(!mBeamDisallowed);
-            if (mNfcAdapter.isNdefPushEnabled() && !mBeamDisallowed) {
+            mAndroidBeam.checkRestrictionAndSetDisabled(UserManager.DISALLOW_OUTGOING_BEAM);
+            if (mNfcAdapter.isNdefPushEnabled() && mAndroidBeam.isEnabled()) {
                 mAndroidBeam.setSummary(R.string.android_beam_on_summary);
             } else {
                 mAndroidBeam.setSummary(R.string.android_beam_off_summary);
diff --git a/src/com/android/settings/notification/SoundSettings.java b/src/com/android/settings/notification/SoundSettings.java
index dae492f..4eb4f7d 100644
--- a/src/com/android/settings/notification/SoundSettings.java
+++ b/src/com/android/settings/notification/SoundSettings.java
@@ -37,6 +37,7 @@
 import android.os.Handler;
 import android.os.Looper;
 import android.os.Message;
+import android.os.UserHandle;
 import android.os.UserManager;
 import android.os.Vibrator;
 import android.preference.SeekBarVolumizer;
@@ -57,6 +58,8 @@
 import com.android.settings.dashboard.SummaryLoader;
 import com.android.settings.search.BaseSearchIndexProvider;
 import com.android.settings.search.Indexable;
+import com.android.settingslib.RestrictedLockUtils;
+import com.android.settingslib.RestrictedPreference;
 
 import java.text.NumberFormat;
 import java.util.ArrayList;
@@ -64,6 +67,8 @@
 import java.util.List;
 import java.util.Objects;
 
+import static com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
+
 public class SoundSettings extends SettingsPreferenceFragment implements Indexable {
     private static final String TAG = "SoundSettings";
 
@@ -164,8 +169,7 @@
         } catch (IllegalArgumentException ignored) {
             isCellBroadcastAppLinkEnabled = false;  // CMAS app not installed
         }
-        if (!mUserManager.isAdminUser() || !isCellBroadcastAppLinkEnabled
-                || mUserManager.hasUserRestriction(UserManager.DISALLOW_CONFIG_CELL_BROADCASTS)) {
+        if (!mUserManager.isAdminUser() || !isCellBroadcastAppLinkEnabled) {
             removePreference(KEY_CELL_BROADCAST_SETTINGS);
         }
         initRingtones();
@@ -186,13 +190,23 @@
         for (VolumeSeekBarPreference volumePref : mVolumePrefs) {
             volumePref.onActivityResume();
         }
-        boolean isRestricted = mUserManager.hasUserRestriction(UserManager.DISALLOW_ADJUST_VOLUME);
+
+        final EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(mContext,
+                UserManager.DISALLOW_ADJUST_VOLUME, UserHandle.myUserId());
         for (String key : RESTRICTED_KEYS) {
             Preference pref = findPreference(key);
-            if (pref != null) {
-                pref.setEnabled(!isRestricted);
+            if (pref instanceof RestrictedPreference) {
+                ((RestrictedPreference) pref).setDisabledByAdmin(admin);
+            } else if (pref != null) {
+                pref.setEnabled(admin == null);
             }
         }
+        RestrictedPreference broadcastSettingsPref = (RestrictedPreference) findPreference(
+                KEY_CELL_BROADCAST_SETTINGS);
+        if (broadcastSettingsPref != null) {
+            broadcastSettingsPref.checkRestrictionAndSetDisabled(
+                    UserManager.DISALLOW_CONFIG_CELL_BROADCASTS);
+        }
     }
 
     @Override
diff --git a/src/com/android/settings/users/UserDetailsSettings.java b/src/com/android/settings/users/UserDetailsSettings.java
index 9a81d16..07d03ee 100644
--- a/src/com/android/settings/users/UserDetailsSettings.java
+++ b/src/com/android/settings/users/UserDetailsSettings.java
@@ -29,6 +29,7 @@
 import com.android.internal.logging.MetricsLogger;
 import com.android.settings.R;
 import com.android.settings.SettingsPreferenceFragment;
+import com.android.settingslib.RestrictedPreference;
 
 import java.util.List;
 
@@ -59,7 +60,7 @@
 
     private UserManager mUserManager;
     private SwitchPreference mPhonePref;
-    private Preference mRemoveUserPref;
+    private RestrictedPreference mRemoveUserPref;
 
     private UserInfo mUserInfo;
     private boolean mGuestUser;
@@ -79,7 +80,7 @@
 
         addPreferencesFromResource(R.xml.user_details_settings);
         mPhonePref = (SwitchPreference) findPreference(KEY_ENABLE_TELEPHONY);
-        mRemoveUserPref = findPreference(KEY_REMOVE_USER);
+        mRemoveUserPref = (RestrictedPreference) findPreference(KEY_REMOVE_USER);
 
         mGuestUser = getArguments().getBoolean(EXTRA_USER_GUEST, false);
 
@@ -102,13 +103,16 @@
             mPhonePref.setChecked(
                     !mDefaultGuestRestrictions.getBoolean(UserManager.DISALLOW_OUTGOING_CALLS));
         }
-        if (mUserManager.hasUserRestriction(UserManager.DISALLOW_REMOVE_USER)) {
-            removePreference(KEY_REMOVE_USER);
-        }
         mPhonePref.setOnPreferenceChangeListener(this);
     }
 
     @Override
+    public void onResume() {
+        super.onResume();
+        mRemoveUserPref.checkRestrictionAndSetDisabled(UserManager.DISALLOW_REMOVE_USER);
+    }
+
+    @Override
     public boolean onPreferenceClick(Preference preference) {
         if (preference == mRemoveUserPref) {
             if (!mUserManager.isAdminUser()) {
diff --git a/src/com/android/settings/users/UserPreference.java b/src/com/android/settings/users/UserPreference.java
index 2daf1ef..61ad6df 100644
--- a/src/com/android/settings/users/UserPreference.java
+++ b/src/com/android/settings/users/UserPreference.java
@@ -17,6 +17,7 @@
 package com.android.settings.users;
 
 import android.content.Context;
+import android.graphics.drawable.Drawable;
 import android.os.UserHandle;
 import android.os.UserManager;
 import android.support.v7.preference.Preference;
@@ -24,12 +25,18 @@
 import android.util.AttributeSet;
 import android.view.View;
 import android.view.View.OnClickListener;
+import android.widget.ImageView;
 
 import com.android.settings.R;
+import com.android.settingslib.RestrictedPreference;
 
 import java.util.Comparator;
 
-public class UserPreference extends Preference {
+import static com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
+
+public class UserPreference extends RestrictedPreference {
+    private static final int ALPHA_ENABLED = 255;
+    private static final int ALPHA_DISABLED = 102;
 
     public static final int USERID_UNKNOWN = -10;
     public static final int USERID_GUEST_DEFAULTS = -11;
@@ -71,6 +78,14 @@
         mUserId = userId;
     }
 
+    private void dimIcon(boolean dimmed) {
+        Drawable icon = getIcon();
+        if (icon != null) {
+            icon.mutate().setAlpha(dimmed ? ALPHA_DISABLED : ALPHA_ENABLED);
+            setIcon(icon);
+        }
+    }
+
     @Override
     public void onBindViewHolder(PreferenceViewHolder view) {
         UserManager um = (UserManager) getContext().getSystemService(Context.USER_SERVICE);
@@ -87,7 +102,8 @@
                 deleteDividerView.setVisibility(View.GONE);
             }
         }
-        View manageView = view.findViewById(R.id.manage_user);
+        final boolean disabledByAdmin = isDisabledByAdmin();
+        ImageView manageView = (ImageView) view.findViewById(R.id.manage_user);
         if (manageView != null) {
             if (mSettingsClickListener != null) {
                 manageView.setOnClickListener(mSettingsClickListener);
@@ -99,8 +115,10 @@
                 manageView.setVisibility(View.GONE);
                 manageDividerView.setVisibility(View.GONE);
             }
+            manageView.setImageAlpha(disabledByAdmin ? ALPHA_DISABLED : ALPHA_ENABLED);
         }
         super.onBindViewHolder(view);
+        dimIcon(disabledByAdmin);
     }
 
     private int getSerialNumber() {
diff --git a/src/com/android/settings/users/UserSettings.java b/src/com/android/settings/users/UserSettings.java
index 7e0711e..06ec966 100644
--- a/src/com/android/settings/users/UserSettings.java
+++ b/src/com/android/settings/users/UserSettings.java
@@ -56,6 +56,7 @@
 import com.android.internal.logging.MetricsLogger;
 import com.android.internal.widget.LockPatternUtils;
 import com.android.settings.ChooseLockGeneric;
+import com.android.settings.DimmableIconPreference;
 import com.android.settings.OwnerInfoSettings;
 import com.android.settings.R;
 import com.android.settings.SelectableEditTextPreference;
@@ -66,6 +67,8 @@
 import com.android.settings.search.BaseSearchIndexProvider;
 import com.android.settings.search.Indexable;
 import com.android.settings.search.SearchIndexableRaw;
+import com.android.settingslib.RestrictedLockUtils;
+import com.android.settingslib.RestrictedSwitchPreference;
 import com.android.settingslib.drawable.CircleFramedDrawable;
 
 import java.util.ArrayList;
@@ -73,6 +76,8 @@
 import java.util.HashMap;
 import java.util.List;
 
+import static com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
+
 /**
  * Screen that manages the list of users on the device.
  * Guest user is an always visible entry, even if the guest is not currently
@@ -126,9 +131,9 @@
 
     private PreferenceGroup mUserListCategory;
     private UserPreference mMePreference;
-    private Preference mAddUser;
+    private DimmableIconPreference mAddUser;
     private PreferenceGroup mLockScreenSettings;
-    private SwitchPreference mAddUserWhenLocked;
+    private RestrictedSwitchPreference mAddUserWhenLocked;
     private int mRemovingUserId = -1;
     private int mAddedUserId = 0;
     private boolean mAddingUser;
@@ -213,7 +218,7 @@
         if (mUserCaps.mIsAdmin) {
             mMePreference.setSummary(R.string.user_admin);
         }
-        mAddUser = findPreference(KEY_ADD_USER);
+        mAddUser = (DimmableIconPreference) findPreference(KEY_ADD_USER);
         // Determine if add user/profile button should be visible
         if (mUserCaps.mCanAddUser) {
             mAddUser.setOnPreferenceClickListener(this);
@@ -223,7 +228,7 @@
             }
         }
         mLockScreenSettings = (PreferenceGroup) findPreference("lock_screen_settings");
-        mAddUserWhenLocked = (SwitchPreference) findPreference("add_users_when_locked");
+        mAddUserWhenLocked = (RestrictedSwitchPreference) findPreference("add_users_when_locked");
         loadProfile();
         setHasOptionsMenu(true);
         IntentFilter filter = new IntentFilter(Intent.ACTION_USER_REMOVED);
@@ -745,7 +750,8 @@
             userPreferences.add(pref);
         }
 
-        if (!mUserCaps.mIsGuest && (mUserCaps.mCanAddGuest || findGuest() != null)) {
+        if (!mUserCaps.mIsGuest &&
+                (mUserCaps.mCanAddGuest || findGuest() != null || mUserCaps.mDisallowAddUser)) {
             // Add a virtual Guest user for guest defaults
             UserPreference pref = new UserPreference(getPrefContext(), null,
                     UserPreference.USERID_GUEST_DEFAULTS,
@@ -755,6 +761,8 @@
             pref.setIcon(getEncircledDefaultIcon());
             pref.setOnPreferenceClickListener(this);
             userPreferences.add(pref);
+            pref.setDisabledByAdmin(
+                    mUserCaps.mDisallowAddUser ? mUserCaps.mEnforcedAdmin : null);
         }
 
         // Sort list of users by serialNum
@@ -788,7 +796,7 @@
         }
 
         // Append Add user to the end of the list
-        if (mUserCaps.mCanAddUser) {
+        if (mUserCaps.mCanAddUser || mUserCaps.mDisallowAddUser) {
             boolean moreUsers = mUserManager.canAddMoreUsers();
             mAddUser.setOrder(Preference.DEFAULT_ORDER);
             preferenceScreen.addPreference(mAddUser);
@@ -798,13 +806,19 @@
             } else {
                 mAddUser.setSummary(null);
             }
+            if (mAddUser.isEnabled()) {
+                mAddUser.setDisabledByAdmin(
+                        mUserCaps.mDisallowAddUser ? mUserCaps.mEnforcedAdmin : null);
+            }
         }
-        if (mUserCaps.mIsAdmin && !mUserCaps.mDisallowAddUser) {
+        if (mUserCaps.mIsAdmin) {
             mLockScreenSettings.setOrder(Preference.DEFAULT_ORDER);
             preferenceScreen.addPreference(mLockScreenSettings);
             mAddUserWhenLocked.setChecked(Settings.Global.getInt(getContentResolver(),
                     Settings.Global.ADD_USERS_WHEN_LOCKED, 0) == 1);
             mAddUserWhenLocked.setOnPreferenceChangeListener(this);
+            mAddUserWhenLocked.setDisabledByAdmin(
+                    mUserCaps.mDisallowAddUser ? mUserCaps.mEnforcedAdmin : null);
         }
     }
 
@@ -998,6 +1012,7 @@
         boolean mIsGuest;
         boolean mCanAddGuest;
         boolean mDisallowAddUser;
+        EnforcedAdmin mEnforcedAdmin;
 
         private UserCapabilities() {}
 
@@ -1012,8 +1027,9 @@
             final UserInfo myUserInfo = userManager.getUserInfo(UserHandle.myUserId());
             caps.mIsGuest = myUserInfo.isGuest();
             caps.mIsAdmin = myUserInfo.isAdmin();
-            caps.mDisallowAddUser = userManager.hasUserRestriction(
-                    UserManager.DISALLOW_ADD_USER);
+            caps.mEnforcedAdmin = RestrictedLockUtils.checkIfRestrictionEnforced(context,
+                    UserManager.DISALLOW_ADD_USER, UserHandle.myUserId());
+            caps.mDisallowAddUser = (caps.mEnforcedAdmin != null);
             if (!caps.mIsAdmin || UserManager.getMaxSupportedUsers() < 2
                     || !UserManager.supportsMultipleUsers()
                     || caps.mDisallowAddUser) {
@@ -1040,6 +1056,9 @@
                     ", mCanAddRestrictedProfile=" + mCanAddRestrictedProfile +
                     ", mIsAdmin=" + mIsAdmin +
                     ", mIsGuest=" + mIsGuest +
+                    ", mCanAddGuest=" + mCanAddGuest +
+                    ", mDisallowAddUser=" + mDisallowAddUser +
+                    ", mEnforcedAdmin=" + mEnforcedAdmin +
                     '}';
         }
     }
@@ -1090,7 +1109,7 @@
                     data.screenTitle = res.getString(R.string.user_settings_title);
                     result.add(data);
 
-                    if (userCaps.mCanAddUser) {
+                    if (userCaps.mCanAddUser || userCaps.mDisallowAddUser) {
                         data = new SearchIndexableRaw(context);
                         data.title = res.getString(userCaps.mCanAddRestrictedProfile ?
                                 R.string.user_add_user_or_profile_menu