I'm trying to find out why a certain user appears to have full control on a site. Using Check Permissions, I can see that the only permissions they are given directly on the site are Read permissions, through a group.
Below that it gives the message "The following factors also affect the level of access" and lists a whole bunch of extra permissions.
Where do these permissions come from?
Some places I've checked are:
- Site Collection Administrators
- Primary and Secondary Site Collection Administrators
- User Policies on the web app
Where else can these come from? and why the heck doesn't sharepoint tell you where each comes from...
edit: ive since found that actually this user was mistakenly added as a member of an AD group which had site collection admin. I would still like to see a good list of possible places where someone can be given permissions besides directly on a site