Do the child sites inherit their permissions from the site  that the user
has Full Control or from one of its parents?

The site  the user  has Full Control on does not inherit permissions from
it's parent. The user has been specifically given Full Control to that
site, and can't create  subsites beneath it.

I'm about 98% sure that only site collection  admins can create  sites

That's what I was afraid of, but I wanted to be sure. Seems kinda weird
because Create Subsites is one of the permissions included in the Full
Control permission set. But from all the testing I've done it seems
that you're right about having to be a site  Collection Administrator.

I'll see your 98% and raise you 2% and say that I'm 100% sure you can.

is it possible that a Policy may be in place on the web app that
prevents the user  from creating sites? (Look specifically to see if the
Create Subsites right is being denied)

Ok, here's the error I'm getting in the log:

DelegateControl: Exception thrown while adding control
'ASP._controltemplates_createsitepanel1_ascx':
System.UnauthorizedAccessException: Access is denied. (Exception from
HRESULT: 0x80070005 (E_ACCESSDENIED)) at
Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception
ex) at
Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(Unauthor
izedAccessException ex) at
Microsoft.SharePoint.Library.SPRequest.OpenWeb(String bstrUrl, String&
pbstrServerRelativeUrl, String& pbstrTitle, String& pbstrDescription,
Guid& pguidID, String& pbstrRequestAccessEmail, UInt32& pwebVersion,
Guid& pguidScopeId, UInt32& pnAuthorID, UInt32& pnLanguage, UInt32&
pnLocale, UInt16& pnTimeZone, Boolean& bTime24, Int16& pnCollation,
UInt32& pnCollationLCID, Int16& pnCalendarType, Int16 pnAdjustHijriDays,
Int16& pnAltCalendarType, Boolean& pbShowWeeks, Int16&
pnFirstWeekOfYear, UInt32& pnFirstDayOfWeek, Int16& pnWorkDays, Int16&
pnWorkDayStartHour, Int16& pnWorkDayEndHour, Int16& pnMeetingCount,
Int32& plFlags, Boolean& bConnectedToPortal, String& pbstrPortalUrl,
String& pbstrPortalName, Int32& plWebTemplateId, Int16&
pnProvisionConfig, String& pbstrDefaultTheme, String&
pbstrDefaultThemeCSSUrl, String& pbstrAlternateCSSUrl, String&
pbstrCustomizedCssFileList, String& pbstrCustomJSUrl, String&
pbstrAlternateHeaderUrl, String& pbstrMasterUrl, String&
pbstrCustomMasterUrl, String& pbstrSiteLogoUrl, String&
pbstrSiteLogoDescription, Object& pvarUser, Boolean& pvarIsAuditor,
UInt64& ppermMask, Boolean& bUserIsSiteAdmin, Boolean& bHasUniquePerm,
Guid& pguidUserInfoListID, Guid& pguidUniqueNavParent, Int32&
plSiteFlags, DateTime& pdtLastContentChange, DateTime&
pdtLastSecurityChange, String& pbstrWelcomePage) at
Microsoft.SharePoint.SPWeb.InitWeb() at
Microsoft.SharePoint.SPWeb.get_Title() at
Microsoft.SharePoint.SPSite.OpenWeb(Guid gWebId, Int32 mondoHint) at
Microsoft.SharePoint.SPSite.OpenWeb(Guid gWebId) at
Microsoft.SharePoint.Portal.SiteDirectory.SiteDirectoryUtil.GetLocalSite
DirectoryLocation(SPWeb rootWeb) at
Microsoft.SharePoint.Portal.SiteAdmin.CreateSitePanel1.OnInit(EventArgs
e) at System.Web.UI.Control.InitRecursive(Control namingContainer)
at System.Web.UI.Control.AddedControl(Control control, Int32 index)
at System.Web.UI.ControlCollection.Add(Control child) at
Microsoft.SharePoint.WebControls.DelegateControl.AddControlResilient(Con
trol ctl)

Any ideas?

I checked the Policies, and there's nothing preventing subsite creation.

Ok, here's what I've discovered, although I can't really explain why.

The site  in question is under a Sites directory, and in order to create
sites under it a user  must at least have Read access to the Sites
directory site, even if the user has Full Control on a site below it.
This doesn't really make sense to me, but it appears to be the way it
works.

Do you actually mean Sites of SitesDirectory in the path. If you mean
SitesDirectory then the site  is being created where a record will
normally be added to a list in the SitesDirectory website. You would
need contribute access to that site or the list can't be updated and the
site won't be created. It's part of the publishing feature set.

Yes, that's what I mean. I tried it with only read permissions on the
SiteDirectory site  and it still created the site, it just didn't add an
entry for the site in the Sites list.

That should work as long as you don't try to add the categorizations to
the Sites list in the site  Directory site. I would suspect you should
probably give the user  R/W access to the Sites list in SitesDirectory as
well.

Based on my WSS experimentation, there are two permissions (along with
their related base permissions) that a user  must have on the top-level
site of a site  Collection in order to create  child sites anywhere in
that Site Collection:

-Manage Permissions
-Create Subsites

Even if a user has Full Control of a child site, if they don't somehow
have these two permissions on the top-level site, they will be unable to
create the child site. Unfortunately, this is not security trimmed out
of the interface so the user isn't informed that they can't create new
child sites until they try; they are then presented with the Access
Denied page.

Any owner of a subsite can create  subsites under him, and he does not
have to be associated with any sites above his sites. I create
subsites all the time and have full  control to create more sub sites
under it.

MOSS 2007 - WSS 3 PROBLEM

* I have a site collection  with many subsites.

* They have unique permissions

* I have added users with full  Control

* Those users with full control  are not able to add other users to the site

* The users with full control click the OK button on the add users page

* They get Error: Access Denied, Sign in as another user

QUESTION:

* Are the site  Collection Administrators the only admins that can add users to subsites?