SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The requirement is to deny the Sub-site Creations for the Site Administrators and allow it for Site collections Admnistrators

Removing the "Create Sub Sites" from the "User permissions for Web application" does the job fine, but the option also denies for Site collections Administrators

I created "Webapplication policy" for Site Collection Administrators Full Control and still its the same result

Does the "User permissions for Web application" overrides "Webapplication policy" ?????

How Do I resolve this issue OOB??

share|improve this question

First, go back to the original settings. In Policy for Web Application, click on Manage Permission Policy Levels on the left. Create a new policy level (name it what you like) then grant all permissions. Check the box next to Site Administrators or auditors. Now you will have a new permission level for that web applicatation. Then you can un-check the Create Sub-sites setting in full control. This will keep the Site Collection Administrators with the ability and the site admins without the ability to create sub-sites.

share|improve this answer
It doesn't work :( Changes to Full Control Policy level is not getting reflected – Vamsi Dec 26 '09 at 5:34
up vote 0 down vote accepted

This is Bug in SharePoint Permission Model, even if we block the Create Subsite permission using a custom permission level. If the user has "Manage Permissions" permission, they can create a new group with full control and create sites

If we block at the webapplication policy then no one can create subsites :(

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.