Hi
We have an SP 2013 on-premise installation that was implemented using the default security and permissions. However after a year of use we need to make some changes to the security and permissions for Site Owners.
For testing purposes, I have created a custom Site Owners permission level that denies branding, which works fine, and this is assigned to the Site Owners group replacing the Full Control permission. The Site Owners Group group owners setting has been assigned to the Site Collection Administrators. This all at the Site Collection level.
We would like to also restrict the level of permissions the Site Owners can give to groups or individuals, in particular they should not be able to give any object the Full Control permission level thereby circumventing our desired restrictions.
Is this doable? This would need to be applied to all Site Collections, or at least replicated.
If there is any advice or guidance you can provide it would be greatly appreciated.