The MANAGE ANY LOGIN POLICY and MANAGE ANY USER system privileges are granted with no administrative rights.