Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We use a Sharepoint 2010.

We want to prevent the Site Administrators assign a specific role (e.g. "Domain\All Users") to a site.

So is it possible to create (maybe with custom code), a blacklist for it? So that the user cannot add specific roles or users?

Or is there another Build in solution, that I didn't found?

share|improve this question
    
Sascha, AFAIK Site Administrators are person whom you trust and they should have rights to give permissions to anyone from domain... OOB I don't think BlackList is available, even if it was, someone needs to add/remove users from this List... May be achievable with a lot of customization [coding]! –  Arsalan Adam Khatri Nov 21 '12 at 11:50
add comment

5 Answers

Would it be possible to create a specific OU in Active Directory for all the users who are allowed to access SharePoint. Then configure People Editor to only include users from that OU like this.

Other option would be to add custom filter for People Editor like this. Search for "Filter Active Directory accounts by using LDAP queries".

share|improve this answer
    
I hat this idea to, i proposed it to our customer. So I think that is the best way to "control" it. –  Sascha Nov 23 '12 at 8:30
    
Added one more option that might be easier if you just want to filter out specific account(s). –  Jussi Palo Nov 23 '12 at 12:45
add comment

Many thx for your replies. The Problem ist not that the admin can't be trust. The Problem is, that the customer, for whom we support the SharePoint, have only thausand licences for the sharepoint.

So When the Admin add a Group with over thousand users in it. The number of licences are exceeded. So I agree that a blacklist is not possible. So we try to find yout a way that user994521 has proposed.

When I'm done with solving this problem, I Post my solution here.

share|improve this answer
add comment

You can Create a Role for Site Administrator and Remove the option in that Role with "Manage Permissions". With that they cant able to give permission even though they have full control. Also i am not sure whether you can Modifiy the Manage Permissions proeprties to avoid the particular user mode.

share|improve this answer
add comment

Sascha,

AFAIK Site Administrators are person whom you trust and they should have rights to give permissions to anyone from domain... OOB BlackList is not available, even if it was, someone needs to add/remove users from this List [again can remove users from Black List to add users anywhere]...

It more depends on the policy you are following and whom you are giving SITE ADMINISTRATOR role!

share|improve this answer
add comment

Site Administrators should only be users who are trusted to do whatever they 'want'. That doesn't mean they should do whatever they want, but as a site admin they can do whatever they want. Applying a governance plan, or statement like "don't add All Users", fails then you should revisit your site admins and possible demote them down to designers or just members. Why do they need that much permission anyway? Sounds like you might be suffering from too many cooks in the kitchen...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.