SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following below was requested in an effort to eliminate any security isses. (We are currently using the default NTLM authentication):

-Create a hidden URL extention for admin's only (new site collection)

-Add the user/password list to a SharePoint list

-Add a second form of autentication to ensure sercurity on the user/password list

I have created a new site collection with the correct site permissions. What would be the recommended way in going about the above instructions? I was thinking about possilby extending the web app and changing the authentication to something more secure such as Kerboros. Any sugesstions are appreciated!

share|improve this question
Is this for an Extranet/Internet scenario? – Dave Wise May 10 '13 at 15:12
right now its in the default zone, but if i did extend it, i would probably put it under the extanet zone. – sharepointaaron May 10 '13 at 17:13
I meant how is the site exposed to users. Is it only internal users that can see it or is it open to the general internet? – Dave Wise May 10 '13 at 17:22
its only internal users – sharepointaaron May 11 '13 at 15:45
up vote 1 down vote accepted

If you are questioning how secure NTLM is then I would suggest that you have far, far larger issues to worry about in your enterprise than merely the security of a list!

SharePoint's security model is pretty solid and has been tested countless times both in Intranet sites as well as Internet sites without any major failing so that should not be an issue. If you are concerned about list access itself, the list can be secured to so that only members of either a SharePoint group or an Active Directory group have access. Naturally, Site collection administrators can still see everything but if you are worried about that, then you can also enable auditing in order to keep tabs on who is accessing what and when. If you are still worried about SCA access then you can isolate the list in its own Site Collection and restrict the list of Site Collection Admins there.

A common alternative is to keep the passwords in an Excel file and then Zip that file with a password. It is not intuitive or easy to manage nor does it allow any of the standard SharePoint functionality but it does give you a second layer of security.

You also might be able to put a OneNote into a SharePoint library with the passwords and password protect it. This eliminates the utility of SharePoint list and view functions but would add the benefit of offline synchronization. This is easier than Excel but not all organizations have embraced OneNote so there is sometimes a learning, deployment or acquisition curve.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.