Can I define a shared security groups for all my sub sites other than the site collection’s security groups

Question

I have created a sub site then I save it as a template. Now I need to define the following permission settings for all the sub sites :-

1. For all the sub sites to define a shared sub sites' admin group.

2. Where these subsites admins will have Edit permission on the sub sites, while they will not have any permission on the site collection level.

Now currently I find that I have only these 2 options:-

1. To define that the sub sites will inherit the permission from the site collection. But in this way the sub site admin will have Edit permission on the site collection also , which I do not want.
2. To define that each site site have unique permission, so in this way I can define sub sites admins without having permissions on the site collection. But in this case I will have to manage the permission for each sub site separately, baring in mind that all the sub sites will have the same security groups

So can anyone advice how I can defined a shared security groups (Visitors, contributors and full control) for all the sub sites, and at the same time to prevent those security groups from having any permission on the site collection level ? Thanks

Answer 1

You can create a subsite under site collection, which will be a parent subsite, and then your other subsites can be children subsites to the newly created parent subsite under site collection, In this way you can define groups at parent subsite which can be inherited by all child subsites

OR

you can break permission at all level and Run this script to give admin rights at every subsite

if ((Get-PSSnapin "Microsoft.SharePoint.PowerShell" -ErrorAction SilentlyContinue) -eq $null) {
       Add-PSSnapin "Microsoft.SharePoint.PowerShell"
}
Write-Output "Starting process"

###### Get the web object that requires the new groups
$websites = Get-SPWeb "http://myserver/sites/*"  #gets all subsies

foreach($web in $websites){
 Write-Output  "$web"
###### If the web object is currently inheriting permission then break the inheritance

if ($web.HasUniquePerm -eq $false)
{
  $web.BreakRoleInheritance($true, $true)
}

###### Remove unnecessary groups/users from the site permissions
for ($i = $web.RoleAssignments.Count – 1; $i -ge 0; $i–-)
{
    Write-Output $web.RoleAssignments
   $web.RoleAssignments.Remove($i)
}

###### Create the new groups

Write-Output "Creating owners"
# Owner Group


if($web.SiteGroups[“$web Owners”] -eq $null){
  $web.SiteGroups.Add(“$web Owners”, $web.Site.Owner, $web.Site.Owner, “Use this group to grant people full control permissions to the $web site”)
}
 Write-Output  "$web --- $web Owners"
$ownerGroup = $web.SiteGroups["$web Owners"]
$ownerGroup.AllowMembersEditMembership = $true
$ownerGroup.Update()


Write-Output "Creating members"
# Members Group
if($web.SiteGroups[“$web Members”] -eq $null){
  $web.SiteGroups.Add(“$web Members”, $web.Site.Owner, $web.Site.Owner, “Use this group to grant people contribute permissions to the $web site”)
}

 Write-Output  "$web --- $web Members"
$membersGroup = $web.SiteGroups["$web Members"]
$membersGroup.AllowMembersEditMembership = $true
$membersGroup.Update()


Write-Output "Creating visitors"
# Visitors Group
if($web.SiteGroups[“$web Visitors”] -eq $null){
  $web.SiteGroups.Add(“$web Visitors”, $web.Site.Owner, $web.Site.Owner, “Use this group to grant people read permissions to the $web site”)
}
 Write-Output  "$web --- $web Visitors"
$visitorsGroup = $web.SiteGroups["$web Visitors"]
$visitorsGroup.AllowMembersEditMembership = $true
$visitorsGroup.Update()


###### Add users to group as required

Write-Output "Adding users"

$user1 = $web.Site.RootWeb.EnsureUser("domain\user1")
$ownerGroup.AddUser($user1)

$user2 = $web.Site.RootWeb.EnsureUser("domain\user2")
$membersGroup.AddUser($user2)

$user3 = $web.Site.RootWeb.EnsureUser("domain\user3")
$visitorsGroup.AddUser($user3)



###### Create a new assignment (group and permission level pair) which will be added to the web object

Write-Output "Adding role assignments"

$ownerGroupAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($ownerGroup)
$membersGroupAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($membersGroup)
$visitorsGroupAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($visitorsGroup)

###### Get the permission levels to apply to the new groups


Write-Output "Adding role definitions"

$ownerRoleDefinition = $web.Site.RootWeb.RoleDefinitions["Full Control"]
$membersRoleDefinition = $web.Site.RootWeb.RoleDefinitions["Contribute"]
$visitorsRoleDefinition = $web.Site.RootWeb.RoleDefinitions["Read"]

###### Assign the groups the appropriate permission level

Write-Output "assigning permissions"

$ownerGroupAssignment.RoleDefinitionBindings.Add($ownerRoleDefinition)
$membersGroupAssignment.RoleDefinitionBindings.Add($membersRoleDefinition)
$visitorsGroupAssignment.RoleDefinitionBindings.Add($visitorsRoleDefinition)

###### Add the groups with the permission level to the site


Write-Output "Adding groups after permissions"

$web.RoleAssignments.Add($ownerGroupAssignment)
$web.RoleAssignments.Add($membersGroupAssignment)
$web.RoleAssignments.Add($visitorsGroupAssignment)

$web.Update()
$web.Dispose()

}
Write-Output "Success"

Read-Host