Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have a sharepoint list. Users should be able to create new items and change some attributes. I gave full access for the users on the list items. But now I think there is a security gap:

what about if some users try to change the items via powershell? Than they would be able to work on the items without controll and without the special forms and without the buisiness inteligence.

Who to handle such situations? Is there a away to deny access via powershell to some users? (one user needs to have access via powershell because the workflow starts some PS-scripts).

share|improve this question
    
Can you please explain how and why end users would be using powershell to manipulate SharePoint? –  Dave Wise May 31 '12 at 15:30
add comment

1 Answer 1

up vote 0 down vote accepted

You should NOT give end users access to the Server or PowerShell

But denying them that will not prevent users from adding list items without using your forms. If they have access to the lists they can use client side object model (or tools developed using these)

If you want control of what enters the SharePoint list you need to control that by the field types, validation on the list. Or if that's not enough write an event receiver.

share|improve this answer
    
So users are always able to make changes on the list with out using the website? So you mean I have to control everything from validation? And how to deny the powershell access? –  MOI Jun 1 '12 at 6:50
    
If user want and have the knowledge (google) they can always circumvent the web site. By default only farm admin can use SharePoint powershell cmdlets –  Per Jakobsen Jun 1 '12 at 8:14
    
But they can't use the objectmodel and so on by default? –  MOI Jun 1 '12 at 8:41
    
They can only use the (server) object model if they can get the code to run on one of the Servers which they shouldn't have access to. But client side object model/REST can be used from anywhere (if they have the permissions to add list items) –  Per Jakobsen Jun 1 '12 at 8:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.