Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Three colleagues and myself have Full Control of our top level site. I don't often log into our site, however, a week ago I did and noticed I no longer had rights, however, my colleagues' rights were fine. Curiousily, I logged in as our Farm Admin and re-added myself at the top level & granted myself Full Control and all was fine. UNTIL today... I'm still listed at top level with Full Control however when I view All Sites, I can only see 3 sites and again, my colleagues' access has not changed. When I 'check permissions', the results are the same for me and my colleagues.

Any suggestions in troubleshooting this would be greatly appreciated!! Thanks in advance.

share|improve this question
    
Please let me know if you find something regarding this issue, I have similar one for months without any clue, described here: sharepoint.stackexchange.com/questions/34354/…. –  Molik Jan 28 '13 at 16:10
add comment

1 Answer

up vote 2 down vote accepted

This is almost always due to an owner somewhere trying to clean up permissions and not realizing what level they are at. There are numerous fixes for this, including locking down permissions, etc. However, to find out when it happened and who did it, run a SharePoint Audit Report (it is in Site Settings at the Site Collection level) and look for security related events. If auditing is not enabled, it really should be at least for key events such as security changes, deletions, etc..

If you and the two other people need full control over the site for site administration and support purposes, you might want to consider using a Web Application Policy instead as those always override any security within the web application itself. These are created in Central Admin - Security - specify web application user policy. The best practice for this is to create an AD group for SP Admins and grant that group Full Control permissions for the associated web applications. Naturally, since this bypasses all Site Collection security, it should not be used if the web application contains highly sensitive data that the admins should not be privy to.

share|improve this answer
    
Also SharePoint Sushi can help to compare permissions between users - you never know where a broken inherit may lurk. –  SPArchaeologist Jan 28 '13 at 16:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.