Looked through a number of threads as well as searched the web for an answer without much luck.

We currently allow users to request a work site and then when we create their site, we add them to a special group called "Leaders". We give them Manage Hierarchy permission by default and want them to be able to add new users to their work site. However, we don't want them or other users outside of the Owners group to be able to add users with Full Control. Is it possible to trim the add users/assign permissions layout so that only users which are in the Owners group can add users with Full Control?


Try this. Don't give them the manage hierarchy permission. Instead, make the "leaders" group the owner of the Visitors, Contributors, etc. groups (or create new ones)... only groups that have permission levels that you want the leaders to be able to assign. The "leaders" should then be able to give other users the appropriate access to the site by just adding them to one of the groups, but they won't be able to give them individual permissions or put users in groups they don't own.

  • One issue with this that I see is that we want the leaders group to be able to break inheritance on certain lists/document libraries when required. We also would like them to be able to create new groups when necessary. We just don't want them to be able to give themselves or others Full Control. Thank you for your suggestion though! On a side note: we're planning on upgrading to SharePoint 2010 in about a year or so, and I've heard that 2010 provides more granularity in regards to permissions/item-level security. Does it provide the level that I'm asking about here?
    – andrew
    Sep 29 '11 at 15:35
  • Maybe this well help spark some more answers/discussion.
    – andrew
    Oct 21 '11 at 18:51
  • Walked away from my computer mid-thought. Maybe rewording my question well help spark some more answers/discussion: If we give users a modified Full Control permission level, allowing them to still add other users and create new groups, is it possible to prevent them and users outside of the Owners group from from adding new users with Full Control permissions? Is this something that an event handler could solve?
    – andrew
    Oct 21 '11 at 19:06
  • If you are giving them the ability to create groups you are giving them permission to manage security, period. And, there isn't an event receiver solution. I think the best route for you at this point would be to create a custom application page that gives them the functionality they need (create groups, assign users, permissions, etc), which runs with elevated privelages. You can give them a link right on the site settings page to make it a nice, neat solution. That way at least you can control what they can and can't do.
    – Jon Lester
    Oct 27 '11 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.