Hot answers tagged

5

You will need Full Control permission level to be able to edit a MasterPage in SharePoint Designer 2010. Reference: User permissions and permission levels (SharePoint Foundation 2010)


3

You are miss-using SPSecurity.RunWithElevatedPrivileges. You need to create (and dispose) new SPSite/SPWeb objects inside the elevated section. Using contextual objects inside the elevated section has not effect on these objects: they're still old SP objects opened with the permissions of the initial user... See for instance the second part of http://...


2

You could add a redirect script (what ever your code of choice is) on load to redirect them to a different page by adding a script editor part to the page. I know it's not an an iron clad solution but just another deterrent.


2

No, if they can read the metadata about an Item (the Document is contained within the Item), they'll be able to open the document itself. But in this case, I'd suggest providing Full Read access on the User Policy of the Web Application.


2

One of my favorite ways to automate repetitive tasks is to use PowerShell + CSOM. The Client Object Model allows me to run my scripts on top of on-prem SharePoint or Office 365 using the exact same code, so I don't have to migrate it in order to make it run in one or the other. Here is an example of how you use the client dll in a PowerShell script to ...


1

BreakRoleInheritance has two params. Just use false and true for copyroleassignments and clearsubscopes respectively then add the groups you want: $list.BreakRoleInheritance($false,$true) $group = $ctx.Web.EnsureUser($group) $roleDef = $web.RoleDefinitions.GetByName($role) $ctx.Load($group) $ctx.Load($roleDef) $roleBinding = New-Object Microsoft.SharePoint....


1

The highest level permission level will take precedence. In your case, the user has Full Control permission. Similar answer here More on SharePoint permission levels


1

The local user is not imported to SharePoint User Profiles. Hence you are unable to login using local user account. You can add local users who belongs to the SharePoint server but not users on the remote client machines. Alternatively using SharePoint User Profiles you can create users and use that for login.


1

SharePoint Office 365 Admin has full control of every object. There is no way you can remove that. One option is to log details of users who are viewing the list/library. You can add JSOM script to capture this information. Also you can put a redirect logic in the pages so if the user is not part of say HR SPGroup then redirect to an access denied page.


1

I was faced with the same issue in a workplace that did not understand exactly how Microsoft products work and the answer is no, the administrator has higher power for a reason. What we have compromised on is to have a third party application that monitors accesses and creates daily/weekly reports so that every intrusion by administrators is justified before ...


1

I don't need to give you academic definition but you should follow the mentioned steps below to check the difference between all permissions level types not only Full control and Contribute Go to site settings > users and permissions > site permissions. From the above ribbon select permission levels You can check the difference between all ...


1

I did something like this, but it was just a list so it may or may not work. I gave everyone create rights to the list. When the created an item a 2010 workflow fired off. I gathered there department info and set it to a variable. It then would look to another list that had a list of departments in one field and in a corresponding field users that where ...


1

You can use Powershell to reset inheritance $webUrl = "http://mycoolsite" $web = Get-SPWeb $webUrl $list = $web.Lists["mycoollib"] foreach ($item in $list.items) { $item.ResetRoleInheritance() } Also to get items that do not inherit permission you can use following powershell script $web = Get-SPWeb "http://mycoolsite" $list = $...


1

I use on-premise but hoping my information might apply. Your comment "access request for a site can only be sent to one admin" may not be true. I recently found that if you separate email addresses with a comma, it will send to both in 2013. In 2010 the separator was a semi-colon. We manage this by requiring multiple site owners and having them listed ...



Only top voted, non community-wiki answers of a minimum length are eligible