locked
Farm Administrator permissions problem in WSS 3.0 RRS feed

  • Question

  • I am using WSS 3.0 on Windows Server 2003.  I have a test environment on which I have all permissions correct.  I am now setting up a Live environment which will be our company intranet and somehow I have made a hash of permissions and cannot put it right.  I have compared the 'Live' with the 'test' and cannot see what is set differently.  They are on different servers, so different installations, but both are WSS 3.0 on Win Server 2003.

    In the Farm Administrators group in Central Administration I cannot edit any member profiles, except the one I am logged in as.  There is no 'EDIT' button for the other profiles, only a 'Close' button.  Also, under the 'Settings' option on this group there is no entry for 'List Settings', I just have 4 entries 'Group Settings', 'view group Permissions', 'Edit group Quick Launch' & 'Set Up Groups'.

    Can anybody shed any light on how I may have ended up with these restrictions on the Farm Administrators group ?

     

    Monday, June 13, 2011 10:37 AM

Answers

  • I think I've now answered my own question.  It's funny how you can puzzle over something for hours, and then as soon as you ask someone else the question the answer springs to mind.

    I wanted to harden up the permissions to prevent colleagues messing about with settings and making undocumented changes to the system.  I had therefore deleted the Domain administrators account from the Farm Administrators group on the Live system.  This left me with the same accounts as on the test system (the BUILTIN\Administrators group, a local Administrator account and 2 domain user accounts).  What I had failed to realise however was this.  On the test system WSS 3.0 was installed under the windows server local administrator account, thus local admin was owner of everything.  On the Live system, WSS 3.0 was installed under the Domain Administrator account, thus Domain Admin was owner of everything.  When I subsequently deleted the Domain Administrator account from the Farm Administrators group, it meant there was no 'owner' there.  When I added the Domain Administrator account back in to the Farm Administrators group and logged into Central Admin with this account I could then edit all the other profiles, and the List Settings menu option re-appeared.

    I thought I'd post my answer in case anyone else falls into the same trap.  Be careful which Windows account you are logged in to the server as when you install WSS 3.0, as it is that account that has default ownership of everything, and it is only the owner that can do certain tasks in WSS 3.0. 

    Fortunately I hadn't yet fully configured the site or added any content, so I think my best bet is to uninstall WSS 3.0 and start again, logged in with the correct account, unless anybody knows how to change the owner without doing this.

    Monday, June 13, 2011 12:58 PM

All replies

  • I think I've now answered my own question.  It's funny how you can puzzle over something for hours, and then as soon as you ask someone else the question the answer springs to mind.

    I wanted to harden up the permissions to prevent colleagues messing about with settings and making undocumented changes to the system.  I had therefore deleted the Domain administrators account from the Farm Administrators group on the Live system.  This left me with the same accounts as on the test system (the BUILTIN\Administrators group, a local Administrator account and 2 domain user accounts).  What I had failed to realise however was this.  On the test system WSS 3.0 was installed under the windows server local administrator account, thus local admin was owner of everything.  On the Live system, WSS 3.0 was installed under the Domain Administrator account, thus Domain Admin was owner of everything.  When I subsequently deleted the Domain Administrator account from the Farm Administrators group, it meant there was no 'owner' there.  When I added the Domain Administrator account back in to the Farm Administrators group and logged into Central Admin with this account I could then edit all the other profiles, and the List Settings menu option re-appeared.

    I thought I'd post my answer in case anyone else falls into the same trap.  Be careful which Windows account you are logged in to the server as when you install WSS 3.0, as it is that account that has default ownership of everything, and it is only the owner that can do certain tasks in WSS 3.0. 

    Fortunately I hadn't yet fully configured the site or added any content, so I think my best bet is to uninstall WSS 3.0 and start again, logged in with the correct account, unless anybody knows how to change the owner without doing this.

    Monday, June 13, 2011 12:58 PM
  • Hi,

     

    I am glad to hear that you have resolved your question by yourself, and thank you for sharing your answer.

     

    Thanks,

    Rock Wang

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com


    Regards, Rock Wang Microsoft Online Community Support
    Tuesday, June 14, 2011 3:32 AM