A while ago, the always respectable Mark Arend wrote a blog post on configuring users across site collections . In his post he mentioned two methods: Setting user permissions for web applications and Using web application policies. With regard to the first method I have a bit of additional information. As Mark noted, the effect of revoking a permission is this: The permission is denied to all users of the site collection(s) The permission disappears from the list of available permissions for a permission level in all site collections you have on that particular web application. With regard to point one note that this also applies to the Site Collection Administrator! Although this is a special role that usually always has access, revoking a permission via User Permissions for Web Application even effects that! Another addition is that permission dependencies also apply here (See my earlier post on this). So when you revoke the Site permission "Open", you effectively close down all site collections on that particular web application. By the way: You will see what the effect is, because when you uncheck "Open", all other permissions will also be unchecked. The one who can control these permissions is the Farm Administrator. So, if you're one, be careful when it comes to setting user permissions for web applications. If you're the site collection administrator and suddenly you're missing some permissions, you know who's butt to kick . I would like...