test the manage settings permission - which should allow you to set the administration settings in the server config page. unsure what else it does. check code.
the admin>server config needs to be secured the admin>manage plugins also needs to be secured
This bug was previously known as http://jira.rhq-project.org/browse/RHQ-1867