SP2013: Can a subsite owner block the site collection owner?

I read some discussion telling me Sharepoint allow subsite owner can block parent site owner. But in my test, the Site Collection owner ALWAYS have FULL PERMISSION on subsite. Is it true?
I have tested in my farm. I login as one Site collection owner (A), create a subsite, then break the subsite permission inheritance. Assign someone (B) as subsite owner. Then I login as the subsite owner (B). Remove everyone but me (B) in the subsite
permission lists.
However, the SC owner (A) can still change the permission for this subsite. I use "check permission" to check against A. A have every permission although he is not belong to any permission group or permission level.  Is it default behaviour?

It is true, you can't block or reduce the permissions assigned to the site collection owner.

Similar Messages

  • Granting access to SharePoint Designer on a SubSite but not the Site Collection

    Is it safe in SharePoint 2010 to give a user the ability to use SharePoint Designer on a SubSite of a Site Collection and not give them permission, other than Visitor access, to the root Site Collection (Parent Site collection)?
    Most importantly, I want to make sure the only damage a user can do is to their own subsite, and not do anything that will impact the Site Collection. 
    I created a test user and granted it FULL access on a test subsite and only view on the parent site collection and was able to use designer logged in as the test user.  I was able to modify the subsite pages and create workflow.  I was not expecting
    this to work based on the following statement in KB article
    http://support.microsoft.com/kb/2592376
    Overall, an user needs to be a member of one of the following groups at the site collection
    level to be able to use SharePoint Designer and modify SharePoint content:
    - Site Collection Administrators
    - Designers
    - Owners
    Does anyone have any advice on this?
    Thanks!

    I think I just found out why in SharePoint 2010 I'm able to give a user "Designer" permissions on a subsite and "Read"  only permission on the parent Site Collection root site and they can still use SharePoint Designer with
    no permission issues in the subsite.
    http://suehernandez.wordpress.com/2013/02/15/sharepoint-designer-2010-you-do-not-have-permission-to-do-this-operation/
    From the Article: "Turns out the reason for these varying behaviors is this:  In 2007, new sites would automatically inherit their
    master pages from their parents.  If you made no changes to that, it inherited right up to the top.  So it’s looking at the master page from the top, in those circumstances.  And as we’ve seen here, if you don’t have Design permissions to it,
    it doesn’t work.
    In the case of a new 2010 site (just a regular Team Site), the new 2010 behavior is to use the Master Page in the gallery it has in its own site.  And since the user is an Administrator (Full Control) of that
    site, then no problem getting to the Master Page!"
    Does anyone have any experience with this?

  • How can i add a special user to the "site collection administrators" of the personal site on sharepoint online when the personal site is creating ?

    when a new personal site is created on the sharepoint online 2013， then the administrator of this personal site will be himself. we can add another person to the "site collection administrators", then this person have full control of this personal
    site.
    but my request is : add this personal to the personal site when the personal site is creating, but not after the personal site has created ?
    Is anybody know how to do that?

    Hi,
    According to your post, my understanding is that you want to add a special user to the "site collection administrators" of the personal site on sharepoint online when the personal site is creating.
    Per my knowledge,
    there is no out of the box way to accomplish this with SharePoint.
    This is a forum which is supported for SharePoint On-Premise.
    Regarding SharePoint Online, for quick and accurate answers to your questions, it is recommended that you initial a new thread in Office 365 forum.
    Office 365 forum
    http://community.office365.com/en-us/forums/default.aspx
    Thanks,
    Linda Li                
    Forum Support
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Linda Li
    TechNet Community Support

  • How can I allow or block the use of local storage by specific sites for all users in my domain.

    How can I allow or block the use of local storage by specific sites for all users in my domain.
    I tried to do this by MMS.cfg but it is not working, the problem is also described in your blog "http://forums.adobe.com/message/3272907".
    What I Want -: "I want to allow youtube for all the users in my domain and this should be listed in Control panel-->flash player-->storage-->local storage setting by site-->websites tab."

    Wow, cor-el... Did you -intend- your reply to be inane, inappropriate and completely inapplicable?
    How would that possibly do what I asked?
    You -might- consider '''''reading''''' the question, -=before=- you reply. And it's really okay to NOT REPLY if you just don't know. Just an idea.
    Feel better, real soon.

  • Can I lock or block the ability to delete safari history?

    Can I lock or block the ability to delete safari history?

    Your child should have their own account. That account can then be restricted with "Parental Controls".
    There is a substantial set of "Parental Controls" available, including limiting to ONLY a WhiteList, OR a blanket "adult sites" restriction with or without an additional BlackList of your choosing.
    There is also a restriction to whom s/he may send emails and with whom s/he may send instant messages. This is important.
    Keep in mind that the REAL enemy on the Internet is not pørn. Pørn may give them a distorted view about how adults deal with sex.
    But pørn will not make arrangements to meet your child after school. The REAL enemy on the Internet is unrestricted Chat rooms with strangers.

  • Good afternoon! We purchased the product Adobe master collection 5.5 AOO Litsense RU. Distribyutiv program has been lost, and now we can not find it on the site. There we find different versions of the program other than Russian. Please tell me where to d

    Good afternoon! We purchased the product Adobe master collection 5.5 AOO Litsense RU. Distribyutiv program has been lost, and now we can not find it on the site. There we find different versions of the program other than Russian. Please tell me where to download it?

    Voronello volume license installation files are available under the end user or deploy to account at https://licensing.adobe.com/.

  • HT1491 I created my account im my iphone, and now I´m trying to buy with my ipad and the site make questions....so I want to know where do I can find this questions in the site...

    I created my account im my iphone, and now I´m trying to buy with my ipad and the site make questions....so I want to know where do I can find this questions in the site...

    I am very happy to report that my server connection tech, which I called via landline, informed me to : 1. Open Tools 2. Scan down to Clear Recent History 3. Delete All. That was it! Unbelievable! Six hours of searching through the Windows catagories. I checked the results on an internet site, and viola! It was gone! Mozilla Firefox seems to remember the usernames and passwords irregardless of the option window that asks if you if want it to remember the user and password. I finally got in touch with my friend and he said he did not answer yes to the window, even though he was aware of it. No damage. I surely do appreciate everyones' concern in this, now what seems to be, a very simple solution. Cudos to Firefox! Thank-you! P.S. I now have to enter my information at the beginning of any password protected sites...no harm done! My friend is now condemned to the 'user account' site! lol...

  • HT4463 I bought the OS Moutain Lion three weeks ago, but I can't download it. The site does not responde. Could somebody help me?

    I bought the OS Moutain Lion three weeks ago, but I can't download it. The site does not responde. Could somebody help me?

    Turn off the Firewall in System Preferences > Security & Privacy > Firewall
    Disable anti virus software.
    Make sure your Mac meets Mountain Lion requirements > Apple - Upgrade your Mac to OS X Mountain Lion.

  • The SharePoint Server Publishing Infrastructure feature must be activated at the site collection level before the Publishing feature can be activated.

    Hi All,
    I am trying to activate the Publishing feature for a SharePoint website using a custom Site Definition File. The problem I am getting
    is when I try to use the custom site template I get an error message:
    New-SPSite : The SharePoint Server Publishing Infrastructure feature must be activated at the site collection level before the Publishing feature can be activated.
    The custom
    Site Definition File snippet is show below:
    <?xml
    version="1.0"
    encoding="utf-8"?>
    <Project
    Title="SiteDefinition1"
    Revision="2"
    ListDir=""
    xmlns:ows="Microsoft
    SharePoint"
    xmlns="http://schemas.microsoft.com/sharepoint/">
      <NavBars>
      </NavBars>
      <Configurations>
        <Configuration
    ID="0"
    Name="SiteDefinitionDelegateControls2">
          <Lists/>
          <SiteFeatures>
            <!--Document
    Set-->     
            <Feature
    ID="{3bae86a2-776d-499d-9db8-fa4cdc7884f8}"
    Name="FeatureDefinition/15/3bae86a2-776d-499d-9db8-fa4cdc7884f8"
    />
            <!--Publishing
    Prerequisites-->     
            <Feature
    ID="{a392da98-270b-4e85-9769-04c0fde267aa}"
    Name="FeatureDefinition/15/a392da98-270b-4e85-9769-04c0fde267aa"
    />
          ...Other Site Features
          </SiteFeatures>
         <WebFeatures>
            <!--2
    Publishing Web-->
         <Feature
    ID="{94c94ca6-b32f-4da9-a9e3-1f3d343d7ecb}"
    Name="FeatureDefinition/15/94c94ca6-b32f-4da9-a9e3-1f3d343d7ecb"/>
         ... Other Web Features
          </WebFeatures>
          <Modules>
            <Module
    Name="DefaultBlank"
    />
          </Modules>
        </Configuration>
      </Configurations>
      <Modules>
        <Module
    Name="DefaultBlank"
    Url=""
    Path="">
          <File
    Url="default.aspx">
          </File>
        </Module>
      </Modules>
    </Project>
    I hope you can help
    Colin

    As the error says.  The Publishing Infrastructure feature must be activated at the Site Collection level where you are creating a new site PRIOR to turning on the Publishing feature.  So if you are trying to use this site definition to create a
    new Site Collection then its not going to work.  If you are trying to create a sub site then make sure that Publishing Infrastructure is enabled in the site collection before trying to create a sub site with this site definition.
    Internally Microsoft does this for the Publishing Portals using custom code.  Here's an article that discusses how to do it in SharePoint 2010.  
    http://msdn.microsoft.com/en-us/library/office/gg615465(v=office.14).aspx
    Compare what's in the article to one of the Publishing templates available out of the box in 2013 and you should be able to find the assembly that is used to load the Publishing features.
    Paul Stork SharePoint Server MVP
    Principal Architect: Blue Chip Consulting Group
    Blog: http://dontpapanic.com/blog
    Twitter: Follow @pstork
    Please remember to mark your question as "answered" if this solves your problem.

  • Check User Can Access the site collection Are Not?

    Hi All 
    I have some requirement to check user can access site are not through powershell?
    Recently we done migration from 2010 to 2013 SP after that i got some problem some users can not access site  but this user have permission in sp 2010 site .
    Regarding this i need to check specific user can loing or Access  the site collection are not. using powershell
    Some one said impersonate user we can check user can open the web are not but i don't know this impersonate.
    Please help me guys.... 

    Hi,
    You can check the permission for specific user with powershell. Here is the link. Hope this will help.

  • Crawl Rule for Crawling Specific Page across all the site collection under one content source

    I have a MOSS 2007 web Application added to SharePoint 2010 Search Service Application Content Source, which is having 50+ Site Collections which follows same template. Every Site collection having one CustomPages Library and CustomPage.aspx. 
    If search Service would like to crawl only CustomPage.aspx from all the site collection under the web application, what would be the Path or Regular expression while creating the Crawl Rule. 
    i have given the path as  http://webapplication/sites/*/CustomPages/CustomPage.aspx, but this is not working. Can anyone help me out with correct path or regular expression in this case.
    Thanks..

    To crawl that page you'd also need to crawl the pages beneath it, otherwise SharePoint will never get to the page to check if it matches a rule. I assume you have some other rules that are blocking the rest of the content of the site?
    Try adding another rule that allows http://webapplication/sites/* then have your include rule beneath that and another exclude rule for
    http://webapplication/sites/*/* beneath that. That should eliminate nearly all the other content and provide you with your custompage.aspx results.

  • User has contribute access but he is not able to access the site collection...

    User has contribute access but he is not able to access the site collection...

    What error does he get.
    Can you share fiddler trace(check if any 404 error)
    what error do we see in ULS Logs
    Create disableloopback
    registry on server
    http://support.microsoft.com/kb/926642/en-us

  • Recycle bin to show all deleted items on the site collection for specific user group

    hi there, is there any way where a certain sharepoint group (i.e. site collection members) to view and restore deleted items on theentire collection, without giving them site collection rights orgive them more rights than necessary? we wanted to create
    aSP group that has the permission to restore deleted items and give them to selected users so that our users won't have to contact us when they want to restore a deleted item

    I don't believe you can. If an item get's deleted it should go to the first recycle bin @ /_layouts/15/RecycleBin.aspx
    The Recycle Bin gives a site collection administrator
    greater control when users delete files, versions of files, list items, libraries, lists, and folders from a SharePoint site by providing a second stage safety net before an item is permanently deleted from a site. When a user deletes an item from the Recycle
    Bin, the item is sent to a second stage Recycle Bin (also known as the Site Collection Recycle Bin) that the site collection administrator manages. This article focuses on how a site collection administrator can manage the Recycle Bin for a site collection.
    https://support.office.com/en-US/Article/Manage-the-Recycle-Bin-of-a-SharePoint-site-collection-5fa924ee-16d7-487b-9a0a-021b9062d14b
    Ibrahim Sukari, Technical Consultant | SharePoint | Dynamics CRM |
    LinkedIn Profile

  • Document ID moving across the site collection

    Thanks for reading, let me explain my scenario before my question
    1. we have huge site collection with full of documents
    2. want to enable document id feature to track of documents
    3. we want to run the process to archive docs which are older than 6 months into different site collection.
    4. after 2 years, we will have 4 archived site collections, documents are spread across the various site collection
    Does document id move across the site collections, still users can get old document using initially assigned document id after archive into different site collection?
    I read some documentation on document iD that it is targeted for Site Collection level.
    S.Venkata Appaji

    Hi Appaji,
    According to your description, my understanding is that you want to preserve the Document ID when moving the documents across site collections.
    Per my knowledge, the document id will be preserved when the document has been moved from one Site Collection to another Site Collection.
    During move operations, SharePoint Server 2010 keeps the document ID. During copy operations SharePoint Server 2010 assigns a new document ID. You can control this by setting a Boolean operator on the PersistID column.
    More references:
    http://msdn.microsoft.com/en-us/library/ee559302(v=office.14).aspx
    http://www.sharepointeurope.com/blog/2013/6/26/sharepoint-moving-a-document-with-a-document-id-to-another-site-collection
    Best regards.
    Thanks
    Victoria Xia
    TechNet Community Support

  • How to disable SCA's from adding other SCA's to the site collection ?

    Hi,
    I have created a web application and under it many site collections. Now I want to disable the feature for any SCA to be able to add any user as SCA's to the site collections. 
    How can i do it? 
    Thank you.

    The only thing I could think of doing would be to create a PowerShell script that checks for the site collection admins you want, and then remove all others. Run this script via Task Scheduler on a regular basis.
    Trevor Seward
    Follow or contact me at...
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Maybe you are looking for