diff --git a/apps/account/serializers/back.py b/apps/account/serializers/back.py
index b2316734..699210e7 100644
--- a/apps/account/serializers/back.py
+++ b/apps/account/serializers/back.py
@@ -16,7 +16,24 @@ class RoleSerializer(serializers.ModelSerializer):
 class BackUserSerializer(serializers.ModelSerializer):
     class Meta:
         model = User
-        fields = '__all__'
+        fields = (
+            'id',
+            'last_login',
+            'is_superuser',
+            'username',
+            'last_name',
+            'first_name',
+            'is_active',
+            'date_joined',
+            'image_url',
+            'cropped_image_url',
+            'email',
+            'email_confirmed',
+            'unconfirmed_email',
+            'email_confirmed',
+            'newsletter',
+            'roles',
+        )
         extra_kwargs = {
             'password': {'write_only': True}
         }
diff --git a/apps/account/views/back.py b/apps/account/views/back.py
index 80775b3a..fbbc986e 100644
--- a/apps/account/views/back.py
+++ b/apps/account/views/back.py
@@ -1,5 +1,6 @@
 from django_filters.rest_framework import DjangoFilterBackend
 from rest_framework import generics, permissions
+from rest_framework.filters import OrderingFilter
 
 from account import models
 from account.models import User
@@ -18,10 +19,10 @@ class UserRoleLstView(generics.ListCreateAPIView):
 
 class UserLstView(generics.ListCreateAPIView):
     """User list create view."""
-    queryset = User.objects.all()
+    queryset = User.objects.prefetch_related('roles')
     serializer_class = serializers.BackUserSerializer
     permission_classes = (permissions.IsAdminUser,)
-    filter_backends = (DjangoFilterBackend,)
+    filter_backends = (DjangoFilterBackend, OrderingFilter)
     filterset_fields = (
         'email_confirmed',
         'is_staff',
@@ -29,6 +30,14 @@ class UserLstView(generics.ListCreateAPIView):
         'is_superuser',
         'roles',
     )
+    ordering_fields = (
+        'email_confirmed',
+        'is_staff',
+        'is_active',
+        'is_superuser',
+        'roles',
+        'last_login'
+    )
 
 
 class UserRUDView(generics.RetrieveUpdateDestroyAPIView):