Most levels of the server and site hierarchy have a corresponding administration group. Although the Web application level does not have a unique administrator group, farm administrators and service administrators have control over the Web applications within their scope. Members of the Farm Administrators group and members of the Administrators group on the local server can define a policy to grant individual users permissions at the Web application level. For more information about policy, see "Policy for Web applications" in the Logical architecture components article.

The groups of users who have administrative permissions at different levels are described in the following list:

• Server or server farm level

  • Farm Administrators group   Members of the Farm Administrators group have permissions to and responsibility for all servers in the server farm. Members can perform all administrative tasks in Central Administration for the server or server farm. Members of this group can also perform command-line operations. This group does not have access to individual sites or their content. However, members can take ownership of a specific site collection if need be (for example, if the administrator of a site leaves the organization and a new administrator must be added).

  • Administrators group   Members of the Administrators group on the local server can perform all farm administrator actions and more, including installing new products or applications, deploying Web Parts and new features to the global assembly cache, creating new Web applications and new Internet Information Services (IIS) Web sites, and starting services. Like farm administrators, members of this group on the local server have no access to site content, by default.

    Note:
    Farm administrators and administrators can also take ownership of specific site collections, if needed. To take ownership, they can add themselves as the site collection administrator by using the Site Collection Administrators page in Central Administration.

• Shared services level

  • SSP administrators   Can control which services are included in a Shared Services Provider (SSP) and configure settings for those services.

  • Service administrators   Can configure settings for a specific service within an SSP. For example, the service administrator for the Search service on Service1 can configure search settings for Service1.

• Site level

  • Site collection administrators   Have the Full Control permission level on all Web sites within a site collection. This means that they have access to content in all sites in that site collection, even if they do not have explicit permissions on that site.

  • Site owners   By default, members of the Owners group for a site have the Full Control permission level on that site. They can perform administration tasks for the site, and for any list or library within that site.

Use the following worksheet to choose administrators and owners for the administration hierarchy:

• Administrators and owners worksheet (http://go.microsoft.com/fwlink/?LinkId=73126&clcid=0x409)

This topic is included in the following downloadable book for easier reading and printing:

• Plan Sites and Features, Part 1

See the full list of available books at Downloadable content for Office SharePoint Server 2007.