Stop Full Control Site Owner from Granting Full Control

Question

I've seen a lot of articles about this but they were kind of dated so I just want to make sure what I'm trying to accomplish is not possible.

When we create a team site, we create three groups (Owners, Members Visitors). The Owners group has full control and we place the trained owner in that group. However, it is then possible for that owner to go and add users to the site and grant them Full Control access. That means that those "owners" have not had the proper training.

Is there any way to gray that option out for full control owners? I don't want my site owners to have the ability to add users to the site at the full control level (other levels are fine of course).

Any suggestions?

Answer 1

First, you'll need to create a custom permission level.

1. Go to Site Actions > Site Permissions.
2. In the ribbon, click Permission Levels.
3. Click on Full Control, then scroll all the way down and click Copy Permission Level.
4. Name your new Permission Level Full Control without Manage Permissions. In the Site Permissions group, uncheck Manage Permissions, then click Create.

Now, assign this custom permission level to your Owners group.

1. Return to Site Actions > Site Permissions.
2. Check the box next to your Owners group and click Edit Permissions.
3. Uncheck the box for Full Control and check the box for Full Control without Manage Permissions, then click OK.

Now, your site owner will no longer be able to grant any permissions to individuals directly; they will only be able to do so by adding those individuals to existing groups. The downside is that any new groups that need to be created will require the Site Collection Owner or Site Collection Administrator to configure their permissions. (The site owner can still create a new group, but cannot grant that group any permissions.)

Answer 2

Yes, it can be controlled through SharePoint Group Settings.

Go to SharePoint Group -> Click on Settings (from menu) -> Group Settings

Then Set the Group Owner to other than the trainer and set the setting "Who can edit the membership of the group?" to Group Owner.

Add the trainer as a member(user) of the group, so he will get the full control to the content but doesn't have rights to make changes to the group.