we want to limit users from changing the settings on a particular library in their my site. Am i right in thinking that to do so we will need to remove them from the site collection administrators group of their own my site? Or is there another way that they can control the rest of their my site and we can just lock down the specific library?
Are there any reasons why we shouldn't remove users from site collection admin of their my site?
We are using SharePoint 2010 Standard SP1
This is a fairly common consideration in enterprise settings, to minimize help desk and IT overhead and to keep some level of order across My Sites (theme and branding particularly).
I've looked at this from a number of angles in past engagements and it looks like the system is making this task very difficult: Name changing back automatically and quota mails sent to site administrator are two of the biggest snags. You can get over them with proper code and procedure, but in the end the simplest solution we found was to create a permission mask on the MySite webapp and specifically block some rights from everyone except farm administrators.
From Central Administration you can specify permission masks that will apply to entire webapps, for specific groups. In your case, you could just block the "Set permissions" right, so they would simply not be able to fiddle with rights on that library.
Next you need to apply this mask to a group. Since it's a "Deny" mask you need to somehow make an AD group that includes "everyone but those allowed to set permissions", i.e. everyone but site administrators (if you apply the mask to just "Everyone", no one will be able to set permissions anywhere in the webapp).
We were lucky that our client already had in place automatic curation tools for their AD domain, so it was possible to add new users to a global group as soon as they appeared in the HR database. Administrator were excluded from that group.
Once created, the mask will be active and regular users will no longer see options to set permissions.
OK we have a solution that works well, in time i will try to create a blog post about it but in the mean time here is an overview with very useful links that you should be able to use to get this working.
There is an excellent discussion of changing the MySite owner by Mark Arend here: http://blogs.msdn.com/b/markarend/archive/2008/04/10/modifying-mysite-owner-security.aspx He talks about the ins and outs of it and why you may not want to do it. He refers to another article by Steve Peschka which is here: http://sharepoint.microsoft.com/blog/Pages/BlogPost.aspx?PageType=4&ListId={72C1C85B-1D2D-4A4A-90DE-CA74A7808184}&pID=794
Whilst the second article is not directly related to changing the My Site owner it describes an approach for modifying My Sites where you write a control to go on the page and perform your customisations in the control. The first time the control is run (loaded on the page) it performs its work and then sets a property on the web to say it has performed it's work, the control uses this property to ensure that it only runs the first time the user goes to their My Site, this prevents it trying to run customisations everytime the user goes to the page. It's not the nicest way to have to customise the My Site but it seems to work well; since it won't run until everything has been created, you don't run into all the problems with provisioning order that you get using feature stapling. In my case rather than putting the control in the master page as he decribes, i created a delegate control and put it into AdditionalPageHead - i didn't need a custom master page, so didn't want to have to provision one especially for this control.
One point to watch out for, that Mark raises in the first article, is that SharePoint automatically changes the title of the My Site to match the display name of the current owner, thus your sites will change title, i put a bit of logic into the control to check for this and fix if requried. However later when we started swapping the owner out for a service account, created especially as a My Site owner, SharePoint stopped swapping the title, not sure why but i have left the logic in there just in case.
Hope this helps
By definition My Sites are meant for users to get Full Access. If you encounter a situation where you really need to remove users' permission from something in its own site collection, you should probably consider re-planning/re-architecting the IA.
On the other hand after SP1 you have the option to add a 2n-ary SharePoint Site Collection Administrator for My Sites, but even so, I would say you should consider rather creating Personalization Sites (http://www.youtube.com/watch?v=2SjUbMrJL5I) & use Target Audience directly under My Sites Host site collection and target those Sites directly which would appear in My Sites Global navigation as the place where you can store specific information.
Hope it helps, C:\Marius
There is now a SharePoint security module available that restricts sensitive content from the view of Site Collection Administrators. It's designed to prevent the "Insider Threat" in SharePoint.
Regards, Scott
If you need to limit users for a library. You can goto Library>>Library Settings>>Permissions for this library. Here you click stop inheriting permissions. So that it will not inherit permission from its parent which is the site. Then add\remove users as per your need. So now only the users mentioned here will have access to the library.
Site Collection Administrators get access to everything nevertheless if you remove them via Library Permissions.
