Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

My farm admin encourages us collection admins to use permission inheritance. However, we have hundreds of Limited Access entries on the top level site, all of whom I assume possess a custom permission somewhere in the site collection.

If I allow a subsite to inherit permissions, every one of these LA entries shows up in the subsite. My site owners go crazy trying to wade through these irrelevant LA entries to discern the real security settings for their sites. The LA entries make them think there are 300 people with some kind of access to their site, which is not the case at all.

Does anyone have experience in dealing with this mess? I believe it all started with our upgrade to 2010 Enterprise. I don't recall seeing this in MOSS 2007.

share|improve this question

2 Answers 2

Copy & paste from documentation, although it doesn't address the question:

Limited Access is a system defined level that SharePoint automatically assigns in the case described here:

Limited Access is a special permission level that cannot be assigned to a user or group directly. The reason it exists is because if you have a library or subsite that has broken permissions inheritance, and you give a user/group access to only that library/subsite, in order to view its contents, the user/group must have some access to the root web. Otherwise the user/group will be unable to browse the library/subsite, even though they have rights there, because there are things in the root web that are needed to render the site or library. Therefore, when you give a group permissions only to a subsite or library that is breaking permissions inheritance, SharePoint will automatically give Limited Access to that group or user on the root web.

share|improve this answer
    
Understood. My question was really about how admins are dealing with the disruption to the user experience in the circumstance I described. –  wbco Mar 15 '12 at 14:22

In this case, Microsoft's implementation is rather poor -- when they copy the permissions from the parent, they blindly copy all the Limited Access entries, whether or not they are relevant.

When are they ever relevant, you ask?

We've seen one obscure case in workflows 'assigning tasks', sometimes recipients receive emails with the following message:

"You do not have access"

If SharePoint doesn't realize the recipient really does have access. A limited access grant can work around this bug.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.