I'm trying to fullfill a requirement which forces the use of Active Directory groups. I'm having issues getting to where I want to be.
Upon creation of a new site, I'm going to use AD groups to assign rights to groups of users. This implies that I need to disable two permission levels: manage rights and create groups, otherwise site owners could still bypass the default assignment. But there is the situation in which a site owner might request a second group to have access to content. To solve that, I would like to grant a group of admins the rights to do this. They and only they should be able to manage rights.
I thought I could get there using web application policies, but it seems to be impossible. Here's what I tried:
- Disable the "manage rights" and "create groups" user permissions. This disables the permissions in the entire webapp. I tried then overriding this with a custom permission level assigned to the admins group using a user policy. Doesn't work.
- I also tried creating a "deny rights" policy for the "all authenticated users" group, and then creating a second policy explicitely granting those permissions again for the admins group, doesn't work either. Even tried the sequence in which the policies are created, no go.
- Tried altering the "Full Control" permission level in CA, which doesn't seem to reflect on the Full Control permission level of the site collections. So altering it doesn't change the rights already assigned to site owners.
The only option I found is altering the OOTB "Full Control" permission level on site collection level. That works, but a site collection administrator can always change it back again. If you want to prevent that, you need to disable the manage rights permission from CA, which again blocks the rights for the admin users as well.
I already found the following two topics, which don't provide a good answer to the question: