Maintain Security on SharePoint 2010 intranet portal based on various departments

Question

We just developed a intranet portal in SharePoint 2010 which is based on different departments like IT, Finance, Sales, Marketing, Audit, Procurement etc etc.

Now Site collection administrator has full rights on the whole site so every confidential document library the site collection admin can access.

What I want is to create administrators of every department's like HR HEAD, Finance Head, Sales Head, Marketing Head of individual site and these heads of department being admin can assign permissions to its sub ordinates within their site only and none of other departments can access department libraries.

What needs to be done in this context and how to achieve this please guide.

Answer 1

Scenario -1 Build a Site Collection. Create subsites with different departments(IT,FINANCE) and then provide access to each subsite seperately by having adminstrators for seperate site.

Scenario -2 Break Inheritance for each site and provide custom permissions for each site

Thanks.

Answer 2

If you are using windows authentication, in our company we have done something similar using security groups of Active Directory. We have a task scheduler that adds, delete or uptade the users into AD groups based on user attributes. For instance, in the attribute Department we store if an user is from HR, Marketing or whatever. So with a scheduled powershell script we manage that groups.

Here you have an example

Then, simply add those groups to SharePoint group and voila!!