Sharepoint Local Administrators 1

[camusa]

Does anybody know how to keep local administrators group from accessing sharepoint sites? I've edited the web.config file which only allows members of the group assigned in it to access the central administration page, but anybody in the local administrators group can access any of the sharepoint sites.

How is everybody else doing this?

Chris

 

[Thomas2000]

Hello,

By default a local administrator on the server will have access to the sharepoint sites without having to be a user, not sure there really is away around that.

You always have this kind of "problem" when it comes to the administrator rights, not just with sharepoint. local administrators on for example a file server also have rights to everything (or almost everything).

Just make sure that you do not have more people than absolutely necesary as members of the local admin (or domain admin) groups. Instead of adding users own accounts to admin groups, create separate admin accounts and be VERY restrictive on access to them (that is how we have solved it here).

You will always have persons/admins that will be able to access almost everything and you just have to make sure that you trust the persons that have these rights not to abuse them. I know that in many companies you as an Admin will have to sign a contract saying that you are not going to abuse etc. the rights as an admin.

Well..some mumbo-jumbo here but just wanted to share my opinion and how we have solved things.

Regards,
Thomas

 

[ChaserNL]

This is possible see this KB article:

http://support.microsoft.com/?kbid=892295&FR=1

Greetings

 

[Thomas2000]

Oh yeah you're right! I've seen that before..but totally forgot it, thanks for reminding me Chaser

Cheers,
Thomas

 

[camusa]

Thanks for the input!

Chris