Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

How do permission levels work? I don't know why I have "access denied" every time I access a subsite even if I have read permission. I am hopeful that somebody will shed light on this.

Here's the scenario:

Intranet (parent site)
|- Intranet Owners (Administrator)
|- Intranet Members (User1, User2)
|- Intranet Visitors (GUser1, GUser2)
|- HR Members (User1) // Contribute permission
|- Corporate Communications Members (User1,User2) // Contribute permission
|- IT Members (GUser1, GUser2) // Contribute permission

Subsites will be the departments:
|- HR (default group - HR Members)
|- Corporate Communications (default group - Corporate Communications Members)
|- IT (default group - IT Members)

Here's the question:
Can GUser1 access the Corporate Communications site? GUser1 has read permission on the site collection level. This is the problem I'm facing right now. I logged in as GUser1 and got an "Access Denied" error. Why?

share|improve this question
    
Did you break permission inheritance on the Corp. Communications site? –  AlexPoint Sep 6 '11 at 7:30
    
I think I did just that. Is this the reason why I got "Access Denied" error? Does the site's permission setting supersedes that of its parent's? –  SPNotSoNewbieNow Sep 6 '11 at 8:07
    
From remote, it's hard to say what has happen in detail. Does the error persists if you switch inheritance back on? –  AlexPoint Sep 6 '11 at 8:51
    
Yes I still have the error after switching back the inheritance. But if GUser1 is added in Intranet Members group, GUser1 can access Corporate Comms' site. If GUser1 is a member of Intranet Visitors, should he be allowed to view the site? That's only read access, I can't understand why GUser1 is denied access. –  SPNotSoNewbieNow Sep 6 '11 at 9:41
    
Is it a subsite or site collection, if the departments are sitecollection you may face problems like this in permissions –  Strider Sep 6 '11 at 10:57

1 Answer 1

up vote 1 down vote accepted

If you're saying that GUser1 has Read permission at the site collection level, depending on how the subsite was created, they might not have access to the communications site. Check the permissions for corporate to ensure the Intranet Visitors group has read permission. By the way you have spelled it out, it does not appear that Guser1 will have access because he is not listed in the Corp Comm users group and you haven't listed Intranet Visitors as having access to the Corp Comm subsite.

Just because a group as permission at the root of a site, it does not mean that it trckles down to everywhere in the collection. If subsites are created with custom permissions, then yhe permissions inheritance is broken from it's parent, and any groups that exist at the parent need to be explicitly added to the subsite.

share|improve this answer
    
Ok got it. But if I set a default group for the corporate communications website, call it CC Members, the site has unique permissions and explicitly add GUser1 as user with read permission to the site, still got "Access Denied" error. Why? –  SPNotSoNewbieNow Sep 7 '11 at 8:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.