Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

On my SP 2007 environment I been trying to have my administrators not use the farm adm account for their administration and use their own credentials. So we started by creating a security group with local admin rights on the server and determined that some of the functionality also required dbo_owner membership towards the content and configuration databases and database server level security (dbcreator, securtityadmin) roles to run stsadm and psconfig operations.

My questions now are:
1. Considering I have more than one web application and more than one site collection, can I manage my administrators via a security group or will I still be required to log in to each site collection and set them as site collection administrators? Previously I've had to log into each and set each as a site collection administrator which only allows to set at a user level (not with a security group).
2. Can a security group be used to manage the maintenance required by Farm Admin to the point where I can avoid any user logging in as a farm admin and set farm account as service only (prevemto)

share|improve this question
add comment

1 Answer

Firstly, SharePoint groups are not supported for permissions @ webapplication or farm level. You can use AD groups

For the Question 1 : You could create Security Policies @ Web Application Level ,which gives full control to all the site collections under that web application. you can use a AD group as well.

For Question 2 : follow this Article

share|improve this answer
    
Appreciate your answer. Yes, the intention is to manage completely through AD. Answer to #1 worked out. As of #2, we had stepped through a similar process and setup. But to clarify my question, now that #1 has been completed, can I avoid any user logging in as a farm admin and set farm account as service only ? Does my group have equivalent rights to farm admin or is there some functionality that I would still need to log in as farm admin? –  user5969 Dec 9 '11 at 12:50
    
Technically yes, but I am not 100% sure as we use the farm admin to install the SharePoint it might automatically give some other hidden rights too; but for all day to day operations I think it should be good. –  Vamsi Dec 9 '11 at 15:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.