how to have registrations pending admin approval

If you use roles, have the admin assign the role, then send email notifying users that they are approved.

That was going to be my suggestion to my client. The new users can login, but the role they are in can do nothing... then, after he approves them he can move them into "active" role so they can see what they are supposed to. The only problem with this method is that I will need to add a lot of text for the users signing up to explain to them that even though they validate their email and get a working login - nothing will be available until they are approved. Also - it still allows spammers to fill the database with bogus logins.
If I just switch to hand-coding this part I can setup a registration form that makes them enter a keyword they receive from my customer in order to "register" and then they don't see the phprunner login until after they are approved.
But - I always like to check for a phprunner way of doing things before I revert to hand coding.
Thanks for your suggestion.

Great Question : If you are using regular version of PHPrunner then yes that is an issue , something I have had. You can alleviate that problem by going to Enterprise edition and using Active Directory as a login which only works for IIS windows. I would like to see an admin module added to regular phprunner also where , the admin gets the registration info first then assigns the group or approves the registration . Otherwise after creating your registration in security module add a field like company code only your company knows to give to new registrars , Then in before registration in events area / event before registration if the company code is incorrect registration = return false else continue return true.

thanks - I do have enterprise edition of phprunner, but I'm not using Active Directory or IIS so I can't go that route. I will check on the company code option you mentioned though - sounds like that might make it better.