The requirement is to deny the Sub-site Creations for the Site Administrators and allow it for Site collections Admnistrators

Removing the "Create Sub Sites" from the "User permissions for Web application" does the job fine, but the option also denies for Site collections Administrators

I created "Webapplication policy" for Site Collection Administrators Full Control and still its the same result

Does the "User permissions for Web application" overrides "Webapplication policy" ?????

How Do I resolve this issue OOB??

2 Answers 2


First, go back to the original settings. In Policy for Web Application, click on Manage Permission Policy Levels on the left. Create a new policy level (name it what you like) then grant all permissions. Check the box next to Site Administrators or auditors. Now you will have a new permission level for that web applicatation. Then you can un-check the Create Sub-sites setting in full control. This will keep the Site Collection Administrators with the ability and the site admins without the ability to create sub-sites.

  • It doesn't work :( Changes to Full Control Policy level is not getting reflected
    – Vamsi
    Commented Dec 26, 2009 at 5:34

This is Bug in SharePoint Permission Model, even if we block the Create Subsite permission using a custom permission level. If the user has "Manage Permissions" permission, they can create a new group with full control and create sites

If we block at the webapplication policy then no one can create subsites :(

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.