SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

SharePoint 2007 Document Library has permissions set for user A to "Read". User A is able to go to Actions -> Open in Windows Explorer and delete files. This seems like a very large security loop hole.

We do not want to remove the Open in Windows Explorer option so is there any way to enforce permissions in this setting?

share|improve this question
up vote 1 down vote accepted

I had the same feeling when using the "Open in Explorer" in SharePoint 2010. User could remove docs in the Explorer view. But when refreshing the documents were still there, so the user could in fact not delete them...

share|improve this answer
Thanks, this was very helpful. I had the users test this and it was true. Fears have been alleviated. – jethomas Mar 21 '12 at 15:30

If User A is logged in as User A (Read Only) in SharePoint, but is logged into their machine as User B (Full Control) then the permissions will be different than expected. Explorer View uses the credentials of the user logged into the machine, NOT the credentials currently used in SharePoint.

This is likely what is causing the confusion (especially if you are testing on your machine). The Explorer View is still respecting the library's permissions, but you may be presenting different credentials than you thought.

share|improve this answer
This was on user A's own machine logged in with their own credentials. – jethomas Mar 16 '12 at 18:26
Also fyi you can set Web DAV to use basic authentication:… This would let you choose who to login with. – Russell Mar 17 '12 at 11:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.