2

I have a business unit "Marketing" and they would like access to Central Admin Search Area.

  1. Is it a good thing to share Central Admin with business unit?
  2. Could I create a special permission that will only allow this group to hit Search Application?
  3. Or I could give them access to Dev area and send the details (step by step process) what they want us to do in Central Admin Search (like custom scopes, etc.)

Please suggest.

1
  • I see you've already selected an answer to your question, which to me sounds like you were looking for someone else to back you up in denying the request. Let's flip this on it's head: what information does Marketing need? Do they have suggestions or want to make changes to the search service configuration? You can delegate service administration to groups or users, so what you are trying to accomplish may be possible. I think if we better understand your goals you may receive a less general answer.
    – shufler
    Jun 8, 2012 at 14:59

2 Answers 2

2

You should never give Central Admin access to anyone that isn't a Farm Administrator and 100% responsible for all actions they take on it.

So to answer your question, no, business units should never have access to that aspect of SharePoint.

It is my opinion that if they can't sit next to you and show you what they want (they already know how to do it), then they should not be touching the most powerful aspect of your SharePoint environment.

That said, Your third suggestion is very much a possibility and depending on your resources not necessarily a bad plan. If you could create a new SharePoint server and instance of SharePoint for them to mess with and set up how they need, you could certainly replicate the steps on your live environment.

Ultimately it comes down to how much trust you are willing to place in the people you are doing this for, and how willing they are (or how willing your boss is) for them to have responsibility for any and all actions they take that affect the environment.

2

I would have to agree with Zork's answer that you should not give business users access to central admin. It's just too powerful and the potential risk to the site if it is (intentionally or unintentionally) abused is enormous.

Even if you try to restrict the user to just one section of CA, which I don't think would be a trivial task, I know that I would be very worried about that holding up, and I wouldn't consider it worth the risk of it not being as foolproof as I had hoped, especially because central admin is not built around giving partial access.

Having said all of that, most of the stuff that you can do in central admin you can do in any server side code or powershell scripts. You could make one or more pages in the front end of your site that perform a function that's somewhat similar to some particular page in central admin. If there is some particular search configuration that the business needs to change regularly you could determine how to make those changes via code, and if you consider the risk acceptable, expose the business to a custom page that runs the code.

Another option to expand on your #3 option, is that you could provide full access for the business to a dev site (if that's not a problem for you) and then have them write a powershell script that makes the configuration changes they need. You could then review the powershell script, ensure it's safe, and then just run the script on all applicable servers. This may or may not be applicable for business users, but I know for our company even the developers don't have central admin access, just the server admins, so when we need to make central admin changes we either need to provide steps for them to do it, or write a job/script (developed against a dev site we do have full access to) that is run in the prod environment(s).

1
  • Servy: Yes, those are very good points. Thanks for pitching in. Jun 8, 2012 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.