Is it possible to give users access to Central Admin but deny them access to change security or permissions.

For example, they can do everything from creating a web application, service application, to doing backups but be unable to do basic things such as giving users access to Central Admin or even deleting them.

Many thanks, Sepaka

  • Can you elaborate a bit more as to why you need this? End users creating web apps and service apps in SharePoint is the stuff of admin nightmares
    – Dave Wise
    Commented Jan 9, 2012 at 17:13
  • Yes, you right Dave. This is for Admins - ofcourse we can't give users access to central admin. We basically looking for a way where we can actually use one account for basic SharePoint Admin tasks. We don't want Admins giving their accounts to CA for security reasons.
    – Sepaka
    Commented Jan 10, 2012 at 13:01

1 Answer 1


I don't believe this can be done at least not without some really heavy customization. Maybe you can mimic the entire CA with custom application pages but then you are reinventing the SP.

In SP2010 you have 2 permission groups for CA: Farm Administrators and Delegated Administrators. If you like to explore more read: SharePoint 2010 Delegated Administration but this doesn't solve your issue.

  • DO you think creating new permission level would help resolve the issue?
    – Sepaka
    Commented Jan 11, 2012 at 8:31
  • As far as I know CA doesn't work like regular front end site. It uses groups to determine permissions (Farm and Delegated Administrators in 2010) Commented Jan 11, 2012 at 8:35
  • Thanks for your reply. It looks like I have a long way to go. Thanks again.
    – Sepaka
    Commented Jan 11, 2012 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.