Prevent users from granting access to "Everyone"

Question

Within our SharePoint 2013 On-Premise farm we want to make sure, that "ordinary" users (namely non site collection administrators) are not able to grant access to the following identities:

• Everyone / c:0(.s|true
• NT Authority\Authenticated Users / c:0!.s|windows

As the ordinary users within our farm can only grant access by adding users to existing groups it would be sufficient for the moment, if we can prevent them from adding the identities to groups.

I've found a thread at serverfault targeting MOSS 2007, saying that you can deny access for Authenticated Users in general via web.config. This approach goes too far as I want site collections administrators to be able to grant access to the identities mentioned above.

Can I implement these requirements via configuration and / or programmatically, e.g. an EventReceiver?

Answer 1

There is no configuration that I know of that will support this. There does seem to be options if you want to code your own event receiver - a quick search shows a few people have done this: https://www.bing.com/search?q=SharePoint+Event+Recieve+USer+Added+to+Group&pc=MOZI&form=MOZSBR

Other options you have are more reactive - like a scheduled powershell script that checks to see if that group is added to groups where it should not be and then removes them. Third party products like AvePoint and ControlPoint do this to enforce policy rules (kind of like Group Policy in Active Directory)