Within our SharePoint 2013 On-Premise farm we want to make sure, that "ordinary" users (namely non site collection administrators) are not able to grant access to the following identities:

  • Everyone / c:0(.s|true
  • NT Authority\Authenticated Users / c:0!.s|windows

As the ordinary users within our farm can only grant access by adding users to existing groups it would be sufficient for the moment, if we can prevent them from adding the identities to groups.

I've found a thread at serverfault targeting MOSS 2007, saying that you can deny access for Authenticated Users in general via web.config. This approach goes too far as I want site collections administrators to be able to grant access to the identities mentioned above.

Can I implement these requirements via configuration and / or programmatically, e.g. an EventReceiver?

1 Answer 1


There is no configuration that I know of that will support this. There does seem to be options if you want to code your own event receiver - a quick search shows a few people have done this: https://www.bing.com/search?q=SharePoint+Event+Recieve+USer+Added+to+Group&pc=MOZI&form=MOZSBR

Other options you have are more reactive - like a scheduled powershell script that checks to see if that group is added to groups where it should not be and then removes them. Third party products like AvePoint and ControlPoint do this to enforce policy rules (kind of like Group Policy in Active Directory)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.