Fun and Games with Site Collection Administrators

 

SharePoint has three kinds of Site Collection Administrators: Primary, Secondary and "other". When you edit the list of admins in Site Actions, Site Settings there is just a list of admins with no indication of kind. So who is the Primary? What happens when the list is edited and the Primary and / or Secondary is removed? Then who's the Primary?

This article has two parts:

• Background on Site Collection Administrators
• Weird Fun and Games

I did my testing in SharePoint 2010, but expect similar results in both 2007 and 2013. I'll test those when I get a chance.

Background

A Site Collection Administrator is:

• a user assigned to the SPSite.Owner property. They are displayed in Central Administration as the "Primary site collection administrator".
• a user assigned to the SPSite.SecondaryContact property. They are displayed in Central Administration as the "Secondary site collection administrator".
• a user added in Site Actions, Site settings as a site collection administrator. They are not displayed anywhere in Central Administration. They are added in the site using Site Actions, Site Settings, Site Collection Administrators. (Both these admins and the Primary and Secondary admins have their SPUser.IsSiteAdmin property set to true.)

What makes them special:

• All Site Collection Administrators have full control over the entire site collection and can see all content. (unless limited by Central Administration, Applications, User Policy)
• Only the Primary and Secondary admins receive administrative email alerts for the site collection (Quota exceeded warnings and Site Use Confirmation and Deletion notices)

Finding them with Central Administration

Finding them with Site Actions, Site Settings

Finding them with PowerShell (just the Primary and Secondary here:

$site = get-spsite http://sharepoint/sites/training
$site.Owner
$site.SecondaryContact

Or for all Site Collections in a web application:

Get-SPWebApplication http://sharepoint | Select -ExpandProperty sites | Select url, owner, secondarycontact | ft -AutoSize

Now for the Fun and Games!

I created a new site collection and assigned:

• Primary Site Collection Administrator (Owner):  susanj
• Secondary Site Collection Administrator (SecondaryContact):  samc

I confirmed the admins in:

Central Admin:

Site Actions, Site Settings:

PowerShell:

Get-SPSite http://sharepoint/sites/test1 | select url, owner, secondarycontact

Url                           Owner             SecondaryContact
---                           -----             ----------------
http://sharepoint/sites/test1 SHAREPOINT\susanj SHAREPOINT\samc

 

Now I add two more Site Collection Administrators from Site Actions, Site Settings:

No change in Central Administration as these new admins are not the Primary/Owner or Secondary/SecondaryContact and have been added as "other site collection admins". (Their IsSiteAdmin property has been set to True.)

For PowerShell we need to add one more request to get the list of "other" admins (IsSiteAdmin=true)…

$site = Get-SPSite http://sharepoint/sites/test1
$web = $site.RootWeb
$web.AllUsers | Select UserLogin, IsSiteAdmin 

UserLogin                IsSiteAdmin
---------                -----------
SHAREPOINT\samc                 True
SHAREPOINT\administrator        True
SHAREPOINT\stellas              True
SHAREPOINT\susanj               True
SHAREPOINT\system              False

So now I have:

• Primary Site Collection Administrator (Owner): susanj
• Secondary Site Collection Administrator (SecondaryContact): samc
• Additional admin: stellas
• Additional admin: administrator

 

Now for the fun…

I logged in as Stella and then using Site Actions, Site Settings I removed sam and susan (the Primary and Secondary). So who is now what?

• Primary Site Collection Administrator (Owner): stellas
• Secondary Site Collection Administrator (SecondaryContact): none!
• Additional admin: administrator

Then I added susan and sam back:

• Primary Site Collection Administrator (Owner): stellas
• Secondary Site Collection Administrator (SecondaryContact): none!
• Additional admin: administrator
• Additional admin: samc
• Additional admin: susanj

I then tried all kinds of combinations of adding and removing admins from Site Actions, Site Settings and from Central Admin.

Learnings

• There are two kinds of Site Collection Administrators: the ones who receive site event emails, and all of the rest. Except for the emails, they all have the same permissions.
• The order of site collection administrators in Site Actions, Site Settings does not tell us who is the Primary or the Secondary. The order is simply the order the users are found in the SPWeb.AllUsers collection, sorted by DisplayName. There is no way to find out who the Primary or Secondary is except for Central Administration and PowerShell.
• If a Primary Site Collection Administrator is deleted from Site Actions, Site Settings, a replacement is automatically selected using the first person found in order by ID. (ID's are assigned in the order users are added to the site collection. First user is ID #1, etc..)
• If a Secondary Site Collection Administrator is deleted from Site Actions, Site Settings, a replacement is not automatically selected. A Secondary Site Collection Administrator can only be added from Central Administration or by using PowerShell.

Obvious, right?

 

.

 

 

 

 

 

 

 

 

a