SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Considering the following scenario :

  • create a SharePoint Site Collection
  • create a new Security Permission Level "Test", with "Manage permissions" checked.
  • create a new Group, with "Contribute", and "Test" checked for its permissions.

Now, if a member of this group goes to "_layouts/user.aspx", he can modify his group permissions, and check "Full Control". Now he is site admin.

Is there a way to prevent this behaviour ?

share|improve this question

migrated from Mar 27 '12 at 16:13

This question came from our site for professional and enthusiast programmers.

up vote 2 down vote accepted

I assume you mean "Manage Permissions"? So as far as I can tell, there is no permission for "Let people manage the permissions of others but not be able to give anyone higher permission than they have"... "Manage Permissions" is effectively "Full Control".

SPSecurityTrimmedControl won't really help because it just changes what the user can see, not what they can do. They could still use webservices or the API to manage permissions.

share|improve this answer
Yes but it's for very end users that aren't likely to use webservices/api :) Still an issue for me, that a group can "raise" its permissions on a site/web – mathieu Sep 20 '08 at 19:04
It is true that you can hide actions from naive users easily in Sharepoint with SPSecurityTrimmedControl, but take care because you are still leaving a security hole that may not be easily noticed by site maintainers. – barryd Sep 21 '08 at 18:13

You can use a SPSecurityTrimmedControl to prevent displaying the group list to anyone but Administrators, but as it is a page located in _layouts, it can be overwritten by a service pack, so I think it is not best practice.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.