0

I have a team site collection inside my sharepoint enterprise server 2013. now i have the built-in group named "Visitors" which have "Read" permission level. and i added multiple AD groups and single users to this group. now members of the "Visitors" group can Read all the site pages + lists items.

now i need to implement a scenario which allow "Visitors" members to add new members to the "Visitors" group.

so i specify the Group Owner for the "Visitors" group to be the "Visitors" group itself. so in this case members of the "Visitors" group will be the group owner, and hence they can add new members. and till now everything is working well.

but i am afraid if doing my above implementation can raise the following security risks inside my sites:-

  1. will the Group owners get extra permissions (beyond the Read permission) on my list items and/or on the site pages when they became part of the Group Owners??

  2. can the Group owner who have Read permission on the site, modify his Group permission level? and grant it extra permission?. so for example can the "Visistors" group owners grant the "Vissiotr" group Edit or Contribute permission?? so in this case Visitors will have Edit permission on the site? or this is not possible, and group owners can only add/remove members, rename the group, but can not grant it extra permission levels??

Thanks

Improve this question

2 Answers 2

Reset to default
2

will the Group owners get extra permissions (beyond the Read permission) on my list items and/or on the site pages when they became part of the Group Owners??

They will not get any extra permissions on the site or lists if they are group owners

can the Group owner who have Read permission on the site, modify his Group permission level? and grant it extra permission?. so for example can the "Visistors" group owners grant the "Vissiotr" group Edit or Contribute permission?? so in this case Visitors will have Edit permission on the site? or this is not possible, and group owners can only add/remove members, rename the group, but can not grant it extra permission levels??

No group owner cant modify the group's permission level. Group owner can only add/delete the users of the group and change settings of the group like description, view membership etc.

So to answer your question, yes it's completely safe to add visitor group as owner of visitor group.

But, if you fear about a situation where users suddenly have more rights and wreak havoc on the site, it is kinda possible. Check below screenshot.

enter image description here

If you have this setting on, then users will be able to add themselves to the group and get the permission level of the group. By default, this is Set to No. But if somebody changes this to yes, then they will inherit the group's permission.

So as a "best practice", in case of visitor group, ensure the Member/Owner group is the owner.

Improve this answer
7
  • Clearly explained , I hope it would give a better insights in terms of permissions.
    – John Zachariah
    Jan 18, 2017 at 6:02
  • What if a member removes other in the group. That will make it complicated right, hence I completely agree to your bottom line. " So as a "best practice", in case of visitor group, ensure the Member/Owner group is the owner. "
    – John Zachariah
    Jan 18, 2017 at 6:05
  • @Gautam can you please advice what you exact mean by "in case of visitor group, ensure the Member/Owner group is the owner" ?? now in my case i define the group owner field to be the group itself. so any member of the group will be the group owner ... are you against this setting ? and can you explain why ?
    – John John
    Jan 18, 2017 at 11:39
  • 1
    I am not against this setting. Its just good practice (cant find link). Yes any member will be group owner, so any person can remove other person from the visitor group. Usually, at my end, we have moderators, who are Site Members/Owners, so they are owners of Visitor group and ensure who joins the site and leaves it. If you trust your users not to abuse the system, then its OK.
    – Gautam Sheth
    Jan 18, 2017 at 11:48
  • @GautamSheth now there is not a real abusing as we only need visitors to allow other users to Read the site.Now when you say on end you have moderators, but in our case no one have a full permission on the sites except me -since i am the only person who know sharepoint-, but i just have a idea;I can create new group named "Our Group Owners" where these users will have restricted read permission, and i will be adding this group as the group owners. so in this case the "Our Group Owners" group members will be responsible to add/remove members on all the groups,What do you think of this setting?
    – John John
    Jan 18, 2017 at 12:26
1

The Group owner can change anything about the group such as adding and removing members or deleting the group. Only one user or group can be the owner.[MSDN]

  1. will the Group owners get extra permissions (beyond the Read permission) on my list items and/or on the site pages when they became part of the Group Owners??

They will not get any extra permission for the list items.

2.......

They won't be able to change the permission level the group has on the site or list.

Improve this answer
6
  • I agree but additional point here is to note that, those members in Visitors group could remove anyone in the same group and that would leave the permissions issue more complicated, Hence as a best practice, Actual Owners can be Group owner here in my opinion.
    – John Zachariah
    Jan 18, 2017 at 6:04
  • @JohnZachariah now if a user remove another user, then the second user will not be able to access the site (unless he is a member of another group), an he can report this and we can add him back. i mean if someone accidentally remove another user then this can be fixed by adding the user back, but if someone intentionally remove other then this is another issue as all users are part of the organization. my point is that the real risk if group owner can grant the group extra permission (and seems from the replies this can not be done),,
    – John John
    Jan 18, 2017 at 11:47
  • @JohnZachariah ... but i will not consider removing a user a real issue if this will happen, as we can investigate the reason and add the user back ... so what is your thoughts on this ?
    – John John
    Jan 18, 2017 at 11:47
  • @Mp can you advice on my above comments please?
    – John John
    Jan 19, 2017 at 1:25
  • @johnG - I am trying to understand your problem. What is the reason for making others give access to others ? Why can't we just add the group "Everyone" in your Visitors group. So everyone has Read access.
    – Arvi
    Jan 19, 2017 at 3:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.