Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote 0 down vote favorite

Is it possible to give access to a user who is a member of one group but NOT a member of another group?

[edit]

In other words, if they belong to a certain group, I need to deny them access. I want to create a group of people who are NOT allowed.

Maybe this can be done through code?

share|improve this question

3 Answers

up vote 0 down vote accepted

Permissions in SharePoint are cumulative. If you give access to one SharePoint group there is no way to deny access to some people of this group for whatever reason.

In your scenario you would need to have 3 SharePoint groups for your business groups 1 and 2:

  • members of group 1 but NOT members of group 2
  • members of group 2 but NOT members of group 1
  • members of group 1 AND group 2
share|improve this answer
I have three groups: group1 and group2 have access to the site, but if any are members of group3, I need to exclude them. – BGM Nov 15 '12 at 1:36
@BGM then you'll need to apply the same logic and create even more SP groups. The key point is that permissions are cumulative, you cannot exclude. – Christophe Nov 15 '12 at 1:42
So, if I have a site which allows groupA but not groupB, and a subsite with broken permissions that allows only groupB (not groupA), that groupB has access to the site, too? – BGM Nov 15 '12 at 3:23
@BGM sorry, I am not sure to follow you... If you break inheritance, What you do on a site doesn't affect the other. But I don't see how this is related to your question. – Christophe Nov 15 '12 at 5:26
Christophe, what I mean is, the group that has permissions to the subsite would not have permissions for the parent. I'm just trying to show an example of the exclusion. – BGM Nov 15 '12 at 14:40
show 2 more comments
up vote 0 down vote

One group being a Sharepoint group? If so yes, you'd just make sure the permissions for the site/list/folder/item are set to what you want. If they are inheriting from a parent, you'd need to break the permissions inheritance from the parent and remove the desired group(s).

share|improve this answer
All of the groups are Active Directory Security groups. – BGM Nov 15 '12 at 1:37
up vote 0 down vote

Okay, all, I found a solution in this post. There is an addon at codeplex that will allow you manage permissions for columns on a particular library or list.

In this fashion, you can allow users into a site, but EXCLUDE them from certain views.

It IS a way of excluding a user from having access instead of including them. I just tried it out on my dev server. You can exclude folks from access to a column or a particular view.

share|improve this answer
this looks interesting, but a word of caution: just hiding columns or restricting regular access to views doesn't mean that the content is protected. A determined user will get access through other paths. From what I understand, this add-on offers "security by obscurity". – Christophe Nov 15 '12 at 5:52
And for the record, if your initial question was really about column level security, there is one true way to achieve this out of the box: use two different lists and lookups. – Christophe Nov 15 '12 at 5:53
Christophe, I believe you are right about the security by obscurity thing. (I was trying to keep the question simple, even though my underlying issue was more broad). Your answer is the correct one, even though I think the codeplex addon will suit my needs. – BGM Nov 15 '12 at 14:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.