Limited Access entries are noise

Question

My farm admin encourages us collection admins to use permission inheritance. However, we have hundreds of Limited Access entries on the top level site, all of whom I assume possess a custom permission somewhere in the site collection.

If I allow a subsite to inherit permissions, every one of these LA entries shows up in the subsite. My site owners go crazy trying to wade through these irrelevant LA entries to discern the real security settings for their sites. The LA entries make them think there are 300 people with some kind of access to their site, which is not the case at all.

Does anyone have experience in dealing with this mess? I believe it all started with our upgrade to 2010 Enterprise. I don't recall seeing this in MOSS 2007.

Answer 1

Copy & paste from documentation, although it doesn't address the question:

Limited Access is a system defined level that SharePoint automatically assigns in the case described here:

Limited Access is a special permission level that cannot be assigned to a user or group directly. The reason it exists is because if you have a library or subsite that has broken permissions inheritance, and you give a user/group access to only that library/subsite, in order to view its contents, the user/group must have some access to the root web. Otherwise the user/group will be unable to browse the library/subsite, even though they have rights there, because there are things in the root web that are needed to render the site or library. Therefore, when you give a group permissions only to a subsite or library that is breaking permissions inheritance, SharePoint will automatically give Limited Access to that group or user on the root web.

Answer 2

In this case, Microsoft's implementation is rather poor -- when they copy the permissions from the parent, they blindly copy all the Limited Access entries, whether or not they are relevant.

When are they ever relevant, you ask?

We've seen one obscure case in workflows 'assigning tasks', sometimes recipients receive emails with the following message:

"You do not have access"

If SharePoint doesn't realize the recipient really does have access. A limited access grant can work around this bug.