diff --git a/app/models/group.rb b/app/models/group.rb
index a1a508e..1362472 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -30,6 +30,8 @@ class Group < Principal
   validates_length_of :lastname, :maximum => 255
   attr_protected :id
 
+  self.valid_statuses = [STATUS_ACTIVE]
+
   before_destroy :remove_references_before_destroy
 
   scope :sorted, lambda { order(:type => :asc, :lastname => :asc) }
diff --git a/app/models/principal.rb b/app/models/principal.rb
index 3aca264..f3e0a3d 100644
--- a/app/models/principal.rb
+++ b/app/models/principal.rb
@@ -24,6 +24,8 @@ class Principal < ActiveRecord::Base
   STATUS_REGISTERED = 2
   STATUS_LOCKED     = 3
 
+  class_attribute :valid_statuses
+
   has_many :members, :foreign_key => 'user_id', :dependent => :destroy
   has_many :memberships,
            lambda {preload(:project, :roles).
@@ -34,6 +36,8 @@ class Principal < ActiveRecord::Base
   has_many :projects, :through => :memberships
   has_many :issue_categories, :foreign_key => 'assigned_to_id', :dependent => :nullify
 
+  validate :validate_status
+
   # Groups and active users
   scope :active, lambda { where(:status => STATUS_ACTIVE) }
 
@@ -178,6 +182,14 @@ class Principal < ActiveRecord::Base
     self.lastname ||= ''
     true
   end
+
+  def validate_status
+    if status_changed? && self.class.valid_statuses.present?
+      unless self.class.valid_statuses.include?(status)
+        errors.add :status, :invalid
+      end
+    end
+  end
 end
 
 require_dependency "user"
diff --git a/app/models/user.rb b/app/models/user.rb
index 1eb2c32..b999361 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -119,6 +119,8 @@ class User < Principal
     end
   end
 
+  self.valid_statuses = [STATUS_ACTIVE, STATUS_REGISTERED, STATUS_LOCKED]
+
   before_validation :instantiate_email_address
   before_create :set_mail_notification
   before_save   :generate_password_if_needed, :update_hashed_password
@@ -872,6 +874,8 @@ end
 class AnonymousUser < User
   validate :validate_anonymous_uniqueness, :on => :create
 
+  self.valid_statuses = [STATUS_ANONYMOUS]
+
   def validate_anonymous_uniqueness
     # There should be only one AnonymousUser in the database
     errors.add :base, 'An anonymous user already exists.' if AnonymousUser.exists?
diff --git a/test/unit/user_test.rb b/test/unit/user_test.rb
index ad06875..ef23e39 100644
--- a/test/unit/user_test.rb
+++ b/test/unit/user_test.rb
@@ -52,6 +52,14 @@ class UserTest < ActiveSupport::TestCase
     assert_kind_of User, @jsmith
   end
 
+  def test_should_validate_status
+    user = User.new
+    user.status = 0
+
+    assert !user.save
+    assert_include I18n.translate('activerecord.errors.messages.invalid'), user.errors[:status]
+  end
+
   def test_mail_should_be_stripped
     u = User.new
     u.mail = " foo@bar.com  "