Our current practices are composed of only using Active Directory groups for large swaths of access, such as the top site collection permissions. Any other permissions are to be handled within SharePoint groups themselves. What is the best way, from a central farm administration context, to manage access given by data owners to other users from within site collections.

It would seem to me that the out of the box tools would start to become unwieldy and wouldn't be scalable as the Farm grows.


  • Converting this to a community wiki as it is not a specific question. It's rather subjective and forms an open request for comment. – Charles Lee Jul 20 '10 at 7:47

As you mentioned the out of the box tools seem a little limited when it comes to managing a large system. The ability for example to see what securable objects an individual has in a site collection or across the farm is non-existant. Being able to also match up if they have access via a AD Security group or directly with their account is also non-existant.

One of the most frequent IT requests I've seen is "give access like John Doe" to which my canned repy is "What access does John Doe have?"

Both DeliverPoint and ControlPoint have capabilities around managing permissions across all sites in the farm. The last time I was "inside" a company versus consulting, it took me less than an hour to prove an extremely quick ROI on the tools.



** Disclaimer **

I worked on the team that wrote the tool.

  • That isn't enough information? Why would I use it? – Mike T Jul 20 '10 at 16:12

ControlPoint is the other popular tool.

  • That isn't enough information? Why would I use it? – Mike T Jul 20 '10 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.