On my SP 2007 environment I been trying to have my administrators not use the farm adm account for their administration and use their own credentials. So we started by creating a security group with local admin rights on the server and determined that some of the functionality also required dbo_owner membership towards the content and configuration databases and database server level security (dbcreator, securtityadmin) roles to run stsadm and psconfig operations.

My questions now are:

  1. Considering I have more than one web application and more than one site collection, can I manage my administrators via a security group or will I still be required to log in to each site collection and set them as site collection administrators? Previously I've had to log into each and set each as a site collection administrator which only allows to set at a user level (not with a security group).

  2. Can a security group be used to manage the maintenance required by Farm Admin to the point where I can avoid any user logging in as a farm admin and set farm account as service only (prevemto)


1 Answer 1


Firstly, SharePoint groups are not supported for permissions @ webapplication or farm level. You can use AD groups

For the Question 1 : You could create Security Policies @ Web Application Level ,which gives full control to all the site collections under that web application. you can use a AD group as well.

For Question 2 : follow this Article

  • Appreciate your answer. Yes, the intention is to manage completely through AD. Answer to #1 worked out. As of #2, we had stepped through a similar process and setup. But to clarify my question, now that #1 has been completed, can I avoid any user logging in as a farm admin and set farm account as service only ? Does my group have equivalent rights to farm admin or is there some functionality that I would still need to log in as farm admin?
    – user5969
    Dec 9, 2011 at 12:50
  • Technically yes, but I am not 100% sure as we use the farm admin to install the SharePoint it might automatically give some other hidden rights too; but for all day to day operations I think it should be good.
    – Vamsi
    Dec 9, 2011 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.