We use a Sharepoint 2010.
We want to prevent the Site Administrators assign a specific role (e.g. "Domain\All Users") to a site.
So is it possible to create (maybe with custom code), a blacklist for it? So that the user cannot add specific roles or users?
Or is there another Build in solution, that I didn't found?
Site Administrators should only be users who are trusted to do whatever they 'want'. That doesn't mean they should do whatever they want, but as a site admin they can do whatever they want. Applying a governance plan, or statement like "don't add All Users", fails then you should revisit your site admins and possible demote them down to designers or just members. Why do they need that much permission anyway? Sounds like you might be suffering from too many cooks in the kitchen...
Sascha,
AFAIK Site Administrators are person whom you trust and they should have rights to give permissions to anyone from domain... OOB BlackList is not available, even if it was, someone needs to add/remove users from this List [again can remove users from Black List to add users anywhere]...
It more depends on the policy you are following and whom you are giving SITE ADMINISTRATOR role!
Many thx for your replies. The Problem ist not that the admin can't be trust. The Problem is, that the customer, for whom we support the SharePoint, have only thausand licences for the sharepoint.
So When the Admin add a Group with over thousand users in it. The number of licences are exceeded. So I agree that a blacklist is not possible. So we try to find yout a way that user994521 has proposed.
When I'm done with solving this problem, I Post my solution here.
You can Create a Role for Site Administrator and Remove the option in that Role with "Manage Permissions". With that they cant able to give permission even though they have full control. Also i am not sure whether you can Modifiy the Manage Permissions proeprties to avoid the particular user mode.
Would it be possible to create a specific OU in Active Directory for all the users who are allowed to access SharePoint. Then configure People Editor to only include users from that OU like this.
Other option would be to add custom filter for People Editor like this. Search for "Filter Active Directory accounts by using LDAP queries".
