SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm stumped by an access phenomenon because I am not sure how the permisssons for accessing a site collection work in this specific scenario:

Even though I shouln't be able to do so, I am accessing my site collection via Webbrowser logged on as my built-in local windows administrator (BUILTIN/Administrator) (who is also a farm administrator).

  • BUILTIN/Administrator is not a site collection admin
  • BUILTIN/Administrator is not a member in any site collection group

And according to this technet documentation by Microsoft I shouldn't be allowed to access my site collection! Can someone explain how come I can still access my site collection anyway?

All other user accounts that are members of the windows administrators group get the access denied error. Only BUILTIN/Administrator does not.

I'm currently doing security consulting work and need clearity on this issue.

Note: I am using a SharePoint 2010 Foundation standalone installation on Windows Server 2008 R2 Standard.

share|improve this question
up vote 5 down vote accepted

Check your web application user policy and see if builtin\administrators have full control.

share|improve this answer
That did the trick! My BUILTIN/Administrator did have full control for the web application and no other user did. Thanks for the hint! :-) – Robert Jost May 31 '12 at 15:57
Before you remove that user check that you're not using it as Search content access account – Per Jakobsen May 31 '12 at 18:35
Hi Per, thanks for the tip! – Robert Jost Jun 1 '12 at 7:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.