Did you "apply to contents" of the project?
I assumed so, but had to ask as I sometimes forget to use it. Did you ask Support? I don't have any site/content admins but am curious about what is going on here. My only other thought was: do these users have "allowed" permissions at another level that may be taking precedence?
Is it possible that site admins always have these permissions, regardless of project level settings? I suppose that was your original question.
Based on the image at the link How Permissions are Set, it seems that may be the case--note "Has the user been specifically assigned a role that allows the capacity?"
Of course, I didn't think "Site Admin" was considered a "role". The terminology and documentation can certainly be confusing for me.
Sorry if I'm no help.
In the Admin Project there are:
1. Admins -- All permissions allowed.
2. All Users -- No permissions allowed.
3. Content Admins -- Most permissions allowed (screen shot above).
That's it. The workbooks have no user/group function filtering, no workbook permissions set during Publish.
Since we use Active Directory I cannot log in as someone else, or even with a dummy account, and test. Very annoying. And the folks with the Content Admin rights are in other parts of the country and in manufacturing (on the plant floor, not at their desk much) so it's not like I can walk to their desk and test
For all I know, the word "Administrator" could just be used as a designation for either type of admin. Yeah, I'll probably need to contact support.
Thanks for this, Toby. I did not realize you couldn't imitate AD users; this is good to know as I was contemplating whether AD would work for us (that limitation would make it impossible for me).
Best of luck!
Matt, I should clarify about AD. When I worked for a previous employer I *did* have a dummy AD account. Here at my new place of employment they are paranoid and looked at me like I was from outer space when I asked. So it depends on the company.
This sounds right to me. Sounds like you think you can limit what a Content Administrator can do by denying a specific permission. Denying shouldn't make a difference to someone with Admin permissions - they're god and you can't say "god except for..." you can only take away their godhood.
Try creating a new group that grants permissions you want your "not quite really a Content Adminstrator" to have?