Within our SharePoint 2013 On-Premise farm we want to make sure, that "ordinary" users (namely non site collection administrators) are not able to grant access to the following identities:
Everyone / c:0(.s|true
NT Authority\Authenticated Users / c:0!.s|windows
As the ordinary users within our farm can only grant access by adding users to existing groups it would be sufficient for the moment, if we can prevent them from adding the identities to groups.
I've found a thread at serverfault targeting MOSS 2007, saying that you can deny access for
Authenticated Users in general via
web.config. This approach goes too far as I want site collections administrators to be able to grant access to the identities mentioned above.
Can I implement these requirements via configuration and / or programmatically, e.g. an