locked
"Full Control" permissions not enough to add users to access groups RRS feed

  • Question

  • I'm trying to add a user to a group. This group gives some access to a subsite (and only to this subsite).

    I have "full control" permission level on the subsite (and also on the root site), but I'm not allowed to do this.

    If I add make my user a member of the site collection administrators group, I can do it no problem, but why do I have to be a site collection administrator to be able to add users on a site, where I already have the "full control" permission set??

    • Edited by Mike Walsh FIN Thursday, March 24, 2011 10:22 AM Ask one question per thread. "Additional question" removed
    • Moved by Mike Walsh FIN Thursday, March 24, 2011 10:22 AM admin q (From:SharePoint - General Question and Answers and Discussion (pre-SharePoint 2010))
    Thursday, March 24, 2011 9:51 AM

Answers

  • Well, without "full control" you won't be able to create groups in the first place. So you can say that is required to have full controll to get controll over a group.

    For the standard groups which are created during site creation the owner group (has full control) is the only one who can add users to all groups, so in a way it is required to have full controll permissions to add users.

    If you are owner of a group with read access or the group is configured so that members can add members you can still add users to a site even if you don't have full controll but o give permissions you need someone with full controll

    • Marked as answer by Emir Liu Thursday, March 31, 2011 10:52 AM
    Thursday, March 24, 2011 1:31 PM

All replies

  • To add a User to a group you have to eihter be site collection administrator or you must be owner of the group. If you go to siteactions->site settings-> people and groups and then access the "Group  Settings" of your group you can see or edit the "group owner". As default the person who created the group is the owner of that group. I would recommend to change it to the default owner group of the site.

    This settings is a security feature since a group can be used anywhere in a sitecollection. If anybody who is able to give a group access to a subsite could also change that group's members than he or she could easily get access to all other subsites by adding himself to the group.


    Thursday, March 24, 2011 11:52 AM
  • Great, thanks for the answer!

    So how does the "Full Control" permission level come into play regarding adding users to groups - this is not related to groups at all I guess?

    Thursday, March 24, 2011 12:10 PM
  • Well, without "full control" you won't be able to create groups in the first place. So you can say that is required to have full controll to get controll over a group.

    For the standard groups which are created during site creation the owner group (has full control) is the only one who can add users to all groups, so in a way it is required to have full controll permissions to add users.

    If you are owner of a group with read access or the group is configured so that members can add members you can still add users to a site even if you don't have full controll but o give permissions you need someone with full controll

    • Marked as answer by Emir Liu Thursday, March 31, 2011 10:52 AM
    Thursday, March 24, 2011 1:31 PM