User permissions for Web application Vs Policy for Web application

Question

The requirement is to deny the Sub-site Creations for the Site Administrators and allow it for Site collections Admnistrators

Removing the "Create Sub Sites" from the "User permissions for Web application" does the job fine, but the option also denies for Site collections Administrators

I created "Webapplication policy" for Site Collection Administrators Full Control and still its the same result

Does the "User permissions for Web application" overrides "Webapplication policy" ?????

How Do I resolve this issue OOB??

Answer 1

First, go back to the original settings. In Policy for Web Application, click on Manage Permission Policy Levels on the left. Create a new policy level (name it what you like) then grant all permissions. Check the box next to Site Administrators or auditors. Now you will have a new permission level for that web applicatation. Then you can un-check the Create Sub-sites setting in full control. This will keep the Site Collection Administrators with the ability and the site admins without the ability to create sub-sites.

Answer 2

This is Bug in SharePoint Permission Model, even if we block the Create Subsite permission using a custom permission level. If the user has "Manage Permissions" permission, they can create a new group with full control and create sites

If we block at the webapplication policy then no one can create subsites :(