I have created a sub site then I save it as a template. Now I need to define the following permission settings for all the sub sites :-

  1. For all the sub sites to define a shared sub sites' admin group.

  2. Where these subsites admins will have Edit permission on the sub sites, while they will not have any permission on the site collection level.

Now currently I find that I have only these 2 options:-

  1. To define that the sub sites will inherit the permission from the site collection. But in this way the sub site admin will have Edit permission on the site collection also , which I do not want.
  2. To define that each site site have unique permission, so in this way I can define sub sites admins without having permissions on the site collection. But in this case I will have to manage the permission for each sub site separately, baring in mind that all the sub sites will have the same security groups

So can anyone advice how I can defined a shared security groups (Visitors, contributors and full control) for all the sub sites, and at the same time to prevent those security groups from having any permission on the site collection level ? Thanks

1 Answer 1


You can create a subsite under site collection, which will be a parent subsite, and then your other subsites can be children subsites to the newly created parent subsite under site collection, In this way you can define groups at parent subsite which can be inherited by all child subsites


you can break permission at all level and Run this script to give admin rights at every subsite

if ((Get-PSSnapin "Microsoft.SharePoint.PowerShell" -ErrorAction SilentlyContinue) -eq $null) {
       Add-PSSnapin "Microsoft.SharePoint.PowerShell"
Write-Output "Starting process"

###### Get the web object that requires the new groups
$websites = Get-SPWeb "http://myserver/sites/*"  #gets all subsies

foreach($web in $websites){
 Write-Output  "$web"
###### If the web object is currently inheriting permission then break the inheritance

if ($web.HasUniquePerm -eq $false)
  $web.BreakRoleInheritance($true, $true)

###### Remove unnecessary groups/users from the site permissions
for ($i = $web.RoleAssignments.Count – 1; $i -ge 0; $i–-)
    Write-Output $web.RoleAssignments

###### Create the new groups

Write-Output "Creating owners"
# Owner Group

if($web.SiteGroups[“$web Owners”] -eq $null){
  $web.SiteGroups.Add(“$web Owners”, $web.Site.Owner, $web.Site.Owner, “Use this group to grant people full control permissions to the $web site”)
 Write-Output  "$web --- $web Owners"
$ownerGroup = $web.SiteGroups["$web Owners"]
$ownerGroup.AllowMembersEditMembership = $true

Write-Output "Creating members"
# Members Group
if($web.SiteGroups[“$web Members”] -eq $null){
  $web.SiteGroups.Add(“$web Members”, $web.Site.Owner, $web.Site.Owner, “Use this group to grant people contribute permissions to the $web site”)

 Write-Output  "$web --- $web Members"
$membersGroup = $web.SiteGroups["$web Members"]
$membersGroup.AllowMembersEditMembership = $true

Write-Output "Creating visitors"
# Visitors Group
if($web.SiteGroups[“$web Visitors”] -eq $null){
  $web.SiteGroups.Add(“$web Visitors”, $web.Site.Owner, $web.Site.Owner, “Use this group to grant people read permissions to the $web site”)
 Write-Output  "$web --- $web Visitors"
$visitorsGroup = $web.SiteGroups["$web Visitors"]
$visitorsGroup.AllowMembersEditMembership = $true

###### Add users to group as required

Write-Output "Adding users"

$user1 = $web.Site.RootWeb.EnsureUser("domain\user1")

$user2 = $web.Site.RootWeb.EnsureUser("domain\user2")

$user3 = $web.Site.RootWeb.EnsureUser("domain\user3")

###### Create a new assignment (group and permission level pair) which will be added to the web object

Write-Output "Adding role assignments"

$ownerGroupAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($ownerGroup)
$membersGroupAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($membersGroup)
$visitorsGroupAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($visitorsGroup)

###### Get the permission levels to apply to the new groups

Write-Output "Adding role definitions"

$ownerRoleDefinition = $web.Site.RootWeb.RoleDefinitions["Full Control"]
$membersRoleDefinition = $web.Site.RootWeb.RoleDefinitions["Contribute"]
$visitorsRoleDefinition = $web.Site.RootWeb.RoleDefinitions["Read"]

###### Assign the groups the appropriate permission level

Write-Output "assigning permissions"


###### Add the groups with the permission level to the site

Write-Output "Adding groups after permissions"



Write-Output "Success"

  • thanks for the helpful reply, but regarding the script if i understand it well; it will get all the sub-sites then remove their groups and then define new ones in this correct ? second question, if i follow the script approach in this case i will have different security groups for each sub site , and let say i want to add new sub site admin for all the sub sites then i have to do this manually at each sub site level ,, is this correct ?
    – John John
    May 18, 2015 at 10:44
  • 1
    1. Yes it will get all Subsites remove groups and define new ones as per the web name 2. Yes since the inheritance is breaking at each subsite level, you will have to add admin manually or you can add define owner who will have full control here at line $ownerGroupAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($ownerGroup) May 18, 2015 at 10:51
  • 1
    I have modified the script so that you will get idea about adding Owner, Members as well as Visitor to respective group May 18, 2015 at 10:54
  • so in this case the first approach of having a shared sub-site is a more reliable way ,, since almost all the sub-sites will have the same permission settings ,, and in case there are specific sub sites that need unique permission setting i can break thei rinheretance with the shared sub site what do u think ??
    – John John
    May 18, 2015 at 10:54
  • 1
    Yes i agree with you, i would prefer Shared-Subsite approach as it would be easy to maintain in future if the count of child subsites grow May 18, 2015 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.