Sharepoint permissions on SBS

Ok – I’ve gotten this question enough that it is definitely time to blog it:

On SBS 2003, you grant your users specifc permissions within your companyweb site (let’s say with Reader level access) – but you find that those users can still do anything they want with the site – add / edit / delete / design.

Why?

This is somewhat hidden – but by default, SBS adds the Domain PowerUsers security group as a member of the SharePoint Administrators security group – so if you used the Power User template when creating your users, they will automatically be Sharepoint admins regardless of the explicit permissions you grant within the companyweb site itself.  In order to correct this, open Active Directory Users & Computers, expand <your_domain> | My Business | Security Groups and open the Properties pages for the Sharepoint Administrators group.  On the Members tab, remove Domain Power Users and you should be good to go.  Note that none of your users will be able to access your companyweb site until you grant them permissions within the site.