Is it possible for a User to create a new User bypassing Admin?

Question

In out organization, We have to create lots of new users in various departments. So, I want Head of Department to create their own users and not approach Admin for same. Is such a thing possible?

Answer 1

No, in my opinion it is not, unless you are using Form Based Authentication.

In FBA, you could even have people themselves create their own users: anonymous user clicks Register, fills in a form with some essential information, a working e-mail address, and that's it. Basically, like you register yourself on most of the websites on the WWW.

But if you are using Windows Authentication things are not that simple (at least from this point of view they are a little more complicated). Windows Authentication makes, most of the time, authentication of users smooth, because the users are already created in Active Directory. They are not created in Sharepoint, just added to different security groups of Sharepoint. The creation of users is handled by the guys who are administering the AD. And it's pretty unlikely that the same rights would be given to any Head Of Department.

What could be done, to ease a little the job of AD admins and of HOD, to implement a workflow (why not in Sharepoint), which would be initiated by the HOD, who fills in all the necessary info, and then assigns it to the AD admin, who could create then the user.

Edit - More explanation on FBA

FBA is an answer to your problems only if the users accessing your Sharepoint site don't need access to other resources too in your company. If they need an AD account anyway to connect to their workstation, to print, to access their mailbox, etc, then an Admin will have to create an AD account for them anyway. Enabling FBA won't solve this problem.

FBA is useful mainly for Internet facing sites or Extranet sites. So if you need to give access to people outside your organization, who will access only your Sharepoint site, then yes, FBA could be a good idea. On this blogpost you wil find a step by step guide on how to enable FBA on your Sharepoint site.

But be aware: Enabling FBA involves some major architectural changes in the way authentication is handled on your Sharepoint site, because you need to go from Classic Mode Authentication to Claims Based Authentication. It should well analyzed before you do it, whether you want to do it, whether it will impact other systems which integrate with Sharepoint or custom developed components, whether you should extend your web application and enable FBA on the extension, etc.

I could give you only a general idea on FBA and on the risks involved. The final decision will have to taken inside your company, after reading more blogposts about it and after analyzing all the risks that could appear.

I'm curious what others have to say on this topic :)

Cheers!