WebApp policy - Permissions for certain users

Question

We have a web application which is setup with policies to deny access to create/manage sites or manage permissions to all users in our company(using an AD group). But during an audit we found that some users had this access(they were part of the group for which the permission was denied).

Apparently an admin (not with us anymore) gave them access somehow. I'm trying to figure out how he was able to give them this access. I don't see the users (who have access) directly or as part of any other group in the user policy.

This is for sharepoint 2010, and I'm using central admin primarily. Anyway I can find out where these users are getting the access from?

Answer 1

There are ways, you could look at groups already (but always starting):

1. Start from SP-CA have a look for the Web Application in cause in the User Policy see if any hard-coded permissions have been added.
2. While still in SP-CA have a look at Site Collection Administrators groups for those site collections causing troubles.
3. Descending then you have always the "Check Permissions" button available in Site Permissions, and then for each sub-container (Sub-Site, List/Library).

Otherwise you need to fallback to some automated tools - don't want to favor any providers, but simply google-it, shall get you some of those.