I have to support Sharepoint on a daily basis but do not have the equivalent of domain access so I'm constantly having to ask the guy in charge of Sharepoint to add me to a new security group to complete my task.

Rather than having to bug him all the time (he is only somewhat technical) it would be easier to simply have the equivalent of domain admin access for Sharepoint (I'm a sys admin and have domain admin access already but this doesn't seem to carry over to FOSS).

What is the equivalent of domain admin access on Sharepoint 2010?

Thanks in advance.

2 Answers 2


SharePoints security rides on Active Directory, yes, but because you are a domain admin doesn't make you have admin access. I guess the word you are looking for is a SharePoint Administrator (Primary or Secondary), which oversees not only the groups and permissions, but the site as well. It's a no bars full access to everything administrative about that site.

If that isn't plausible, a "Full Control" access to the site will do the trick, as the groups are tied to the site.

On a side note, if one security AD is in a SharePoint group, any users you throw into that AD group will propagate to have access to the group(s) they are tied to...


To word the answer more precisely:

A SharePoint Farm Administrator has the ability to take and grant others the permissions to certain web applications and site collections but does not necessarily have the rights to content web applications and sites initially.

A user with User Policy for Web Application configured by the Farm Administrator for their account could be Denied Write, Denied All access or granted Full Read or Full Control to all site collections within the web application regardless of the points where granular permissions break the inheritance of access settings. Note that this is the only way to explicitly deny permissions.

A Site Collection administrator (Primary and Secondary owners) can be configured by a Farm Administrator. Such a user has Full Control within the owned site collection regardless of the points where granular permissions break the inheritance of access settings. Note that there can be other site collections within the same web application that this user would not necessarily have access to.

A user with Full Control granted only as being part of a Site Owners group or individually will be respecting the granular permissions below the point where Full Control was initially granted. So there could be sister sites and areas inside such a site where this guy would have no access at all or something other than Full Control.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .