Considering the following scenario :

  • create a SharePoint Site Collection
  • create a new Security Permission Level "Test", with "Manage permissions" checked.
  • create a new Group, with "Contribute", and "Test" checked for its permissions.

Now, if a member of this group goes to "_layouts/user.aspx", he can modify his group permissions, and check "Full Control". Now he is site admin.

Is there a way to prevent this behaviour ?

2 Answers 2


I assume you mean "Manage Permissions"? So as far as I can tell, there is no permission for "Let people manage the permissions of others but not be able to give anyone higher permission than they have"... "Manage Permissions" is effectively "Full Control".

SPSecurityTrimmedControl won't really help because it just changes what the user can see, not what they can do. They could still use webservices or the API to manage permissions.

  • Yes but it's for very end users that aren't likely to use webservices/api :) Still an issue for me, that a group can "raise" its permissions on a site/web
    – mathieu
    Sep 20, 2008 at 19:04
  • It is true that you can hide actions from naive users easily in Sharepoint with SPSecurityTrimmedControl, but take care because you are still leaving a security hole that may not be easily noticed by site maintainers.
    – barryd
    Sep 21, 2008 at 18:13

You can use a SPSecurityTrimmedControl to prevent displaying the group list to anyone but Administrators, but as it is a page located in _layouts, it can be overwritten by a service pack, so I think it is not best practice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.