Allowing the creation of users but not letting them be assigned to the Administrators group?

Question

Hi
I am using Project Server 2013 on-prem, with Project Server Security. We have defined a local administrator group that is intended to allow for a limited set of permissions to local administrators. The reason for this is that we need the individual offices
in a global company to be able to add their own users, but we want the ability to change configuration of Project Server to be controlled centrally.
However I have found that once I give Manage Users and Groups permission to a user in this Local Administrator group they can then simply add themselves to the Administrator group anyway.
Setting policy and training is not proving effective, hence I need to limit this. The desire is for a group that can create users and add values to lookup tables, but not add themselves to the Administrator group.
Is this possible?
Thanks
Ryan

Answer 1

You could still take the approach of having your helpdesk assign the permissions and remove the manage users and groups permissions from the local administrators in an office (as opposed to switching to the different permission model).
I'm curious how training and policy isn't working -- you've asked (told) the users not to add themselves to the administration group and yet they do it anyway? Are they doing this so they have permissions to perform some other tasks?
Jason Warren
@jaspnwarren
jasonwarren.ca
habaneroconsulting.com/Insights