we want to limit users from changing the settings on a particular library in their my site. Am i right in thinking that to do so we will need to remove them from the site collection administrators group of their own my site? Or is there another way that they can control the rest of their my site and we can just lock down the specific library?

Are there any reasons why we shouldn't remove users from site collection admin of their my site?

We are using SharePoint 2010 Standard SP1

  • I am also facing the same requirement. Could you inform me, if you could achive it?
    – Hojo
    Nov 21, 2011 at 6:29
  • 1
    We created a feature that changes SPSite.Owner to a different username (of a domain user created for this purpose), the code should probably be wrapped in a call to SPSecurity.RunWithElevatedPrivileges. This feature can then be stapled to the creation of My Sites, see this blog for useful discussion - sharepoint.microsoft.com/blog/Pages/…{72C1C85B-1D2D-4A4A-90DE-CA74A7808184}&pID=794.
    – toby
    Nov 22, 2011 at 10:53
  • If you are making other customisations too you should bare in mind the order things are provisioned when a site is created - see here sharepointchick.com/archive/2009/04/29/… Hope this helps Toby
    – toby
    Nov 22, 2011 at 10:53
  • I'm curious if you could explain why this requirement exists? The spirit of My Sites is that it is a personal place in the farm where a user has full control over their content. Based on your question, it sounds like it might make more sense to create a library in a site in one of your other site collections (i.e. outside of My Sites) where you can control the permissions.
    – shufler
    Dec 20, 2011 at 17:42
  • 1
    Hi shufler, i agree that the spirit of my sites is that the user has full control over their content. We are trying to educate the business and have been doing trials. There is a desire to force users to work on any shared documents in an area where they must be tagged with metadata. They are worried that users could just use their My Site shared documents library to work on documents with others and bypass colaboration areas.
    – toby
    Dec 21, 2011 at 14:18

5 Answers 5


This is a fairly common consideration in enterprise settings, to minimize help desk and IT overhead and to keep some level of order across My Sites (theme and branding particularly).

I've looked at this from a number of angles in past engagements and it looks like the system is making this task very difficult: Name changing back automatically and quota mails sent to site administrator are two of the biggest snags. You can get over them with proper code and procedure, but in the end the simplest solution we found was to create a permission mask on the MySite webapp and specifically block some rights from everyone except farm administrators.

From Central Administration you can specify permission masks that will apply to entire webapps, for specific groups. In your case, you could just block the "Set permissions" right, so they would simply not be able to fiddle with rights on that library.

Next you need to apply this mask to a group. Since it's a "Deny" mask you need to somehow make an AD group that includes "everyone but those allowed to set permissions", i.e. everyone but site administrators (if you apply the mask to just "Everyone", no one will be able to set permissions anywhere in the webapp).

We were lucky that our client already had in place automatic curation tools for their AD domain, so it was possible to add new users to a global group as soon as they appeared in the HR database. Administrator were excluded from that group.

Once created, the mask will be active and regular users will no longer see options to set permissions.

  • Louis, this seems to me a very intuitive solution. Could you please tell me more details about it on how you have implemented it? Just outlines some details and I will handle it myself. Thank you
    – Geek
    Jul 5, 2012 at 23:21
  • Hi Louis, coould you please post the solution details?
    – Geek
    Jul 6, 2012 at 14:03
  • @SP Geek - Sorry for the delay, I edited the post to add more details. Tell me if it is still not clear.
    – Louis
    Jul 10, 2012 at 0:52

OK we have a solution that works well, in time i will try to create a blog post about it but in the mean time here is an overview with very useful links that you should be able to use to get this working.

There is an excellent discussion of changing the MySite owner by Mark Arend here: http://blogs.msdn.com/b/markarend/archive/2008/04/10/modifying-mysite-owner-security.aspx He talks about the ins and outs of it and why you may not want to do it. He refers to another article by Steve Peschka which is here: http://sharepoint.microsoft.com/blog/Pages/BlogPost.aspx?PageType=4&ListId={72C1C85B-1D2D-4A4A-90DE-CA74A7808184}&pID=794

Whilst the second article is not directly related to changing the My Site owner it describes an approach for modifying My Sites where you write a control to go on the page and perform your customisations in the control. The first time the control is run (loaded on the page) it performs its work and then sets a property on the web to say it has performed it's work, the control uses this property to ensure that it only runs the first time the user goes to their My Site, this prevents it trying to run customisations everytime the user goes to the page. It's not the nicest way to have to customise the My Site but it seems to work well; since it won't run until everything has been created, you don't run into all the problems with provisioning order that you get using feature stapling. In my case rather than putting the control in the master page as he decribes, i created a delegate control and put it into AdditionalPageHead - i didn't need a custom master page, so didn't want to have to provision one especially for this control.

One point to watch out for, that Mark raises in the first article, is that SharePoint automatically changes the title of the My Site to match the display name of the current owner, thus your sites will change title, i put a bit of logic into the control to check for this and fix if requried. However later when we started swapping the owner out for a service account, created especially as a My Site owner, SharePoint stopped swapping the title, not sure why but i have left the logic in there just in case.

Hope this helps

  • We want users to use the mysite and the my content section, but we do not want them to create additional subsites. We use featue stabling to change the masterpage and would like the feature to remove permissions and change the site owner. Would you like to share your code on changing the site owner?
    – user8196
    May 4, 2012 at 9:52

By definition My Sites are meant for users to get Full Access. If you encounter a situation where you really need to remove users' permission from something in its own site collection, you should probably consider re-planning/re-architecting the IA.

On the other hand after SP1 you have the option to add a 2n-ary SharePoint Site Collection Administrator for My Sites, but even so, I would say you should consider rather creating Personalization Sites (http://www.youtube.com/watch?v=2SjUbMrJL5I) & use Target Audience directly under My Sites Host site collection and target those Sites directly which would appear in My Sites Global navigation as the place where you can store specific information.

Hope it helps, C:\Marius


There is now a SharePoint security module available that restricts sensitive content from the view of Site Collection Administrators. It's designed to prevent the "Insider Threat" in SharePoint.

Regards, Scott


If you need to limit users for a library. You can goto Library>>Library Settings>>Permissions for this library. Here you click stop inheriting permissions. So that it will not inherit permission from its parent which is the site. Then add\remove users as per your need. So now only the users mentioned here will have access to the library.

Site Collection Administrators get access to everything nevertheless if you remove them via Library Permissions.

  • 2
    Hi Paddy, the owner of the my site will have site collection admin permissions, so they could still change the library, or it's permissions.
    – toby
    Oct 21, 2011 at 11:01
  • if you need to restrict even your administrator to view some of your files, then enable audience targeting settings unser library settings. After enabling this you can be able to specify the audience for each of the file being uploaded. Once you mention a user as an audience for a file that is uploaded, Only that user can view that file others not even site collection administrator can view it.
    – Strider
    Oct 21, 2011 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.