Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have an AD group called "internal users" which has read-only access to the whole root site for my site collection. Everyone is fine with the access, as long as I don't move them out from this group to some other group, even when that group have read-only access to the root site, too.

The only workaround for this, is to give the users a role of Site Collection Administrators, which of course is not acceptable in any reasonable circumstance.

We are using AD domain groups and not SharePoint groups to manage authorization to our sharepoint solution.

The problem is that every user who is not in the "internal users" or "site collection administrators" group has no access to the root site, they get an "access denied" error.

Do you know what might be happening to my site collection/web application in this case? any ideas so as to know what should be checked?

share|improve this question
    
What exactly is the problem and what errors are the users getting and where do they see the error? –  Dave Wise May 3 '13 at 19:28
    
The users are not having access when trying to get into mysite. If I give them access to internal resources (such as lists and folders within the root site) they can using the exact resource URL. All AD groups have access to the root site in read-only mode so there should not be problems. –  madprofessor May 3 '13 at 19:38
    
Are you using the default "Read" permission level or did you create a custom permission level? –  Dave Wise May 3 '13 at 19:46
    
It is the default "read" permission. Even my "internal users" group has it on the root site. I wonder if there was some possibility that, at farm installation time, the admin. had bound the "internal users" group to some permission on the then newly installed farm. –  madprofessor May 3 '13 at 19:49
    
It is certainly possible for an administrator to screw up security so bad that all site security has to be reset via PowerShell and rebuilt by hand. I've seen it and it is not pretty. –  Dave Wise May 3 '13 at 20:00
add comment

2 Answers

Dive into your Read permission level and verify that the following options are checked:

  • View Application Pages
  • View Pages
  • Use Remote Interfaces
  • Use Client Integration Features

Those not being checked would cause the exact behavior you describe

share|improve this answer
add comment

it turned out to be a non-approved master page that the root site default page was using. That explains why site collection administrators could access the site without problem.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.