0

I created a site. During the process, I selected to have unique permissions and let SP create the new, default groups: Site Owners, Site Members, and Site Visitors. I created a standard list and set item level permissions to allow people to only read and edit their own items. I added my own domain login account to the owners group and User1 (another domain login) to the members group. I then created an item using my account. Next, I logged in as User1 using the site menu (sign in as a different user). I was still able to read and edit the item I created under my own account. User1 is not a member of the Site Owners group. I thought the default members group, which has contribute permissions, would adhere to the item level security setting on the list. Any ideas?

2 Answers 2

2

You need to understand the security structure of SharePoint. Permissions in SharePoint are inherited from Top to Bottom and not the other way around. So what is exactly Top to Bottom - The hierarchy of secured objects in a site.

Site Collection > Site > List/Libraries > Item

SharePoint supports unique permissions across any of the above. So if you have User A with Read rights at Site Collection level , all subsequent objects (Site, List and Items) under that site collection will be readable to the User A. One can stop the inheritance and provide unique access beyond the site collection level.

Coming to your problem: You have a list and items that are secured uniquely for targeted users. Now list supports two ways of filtering content in a way that the user who creates content is able to see his/her items only and not all the items in the list.

  1. List Settings > Advanced Settings > enter image description here

  2. Modify the default view > Filter > Select Show items only when the following is true:

    Created by > Is Equal to > [Me]

So, essentially security groups in SharePoint will play lesser role with Item level permissions in list if you have any of the above two approach implemented.

1
  • Hi. Thanks for your reply. The image in item 1 does not show. Also, if I am understanding you correctly, I did break inheritance for the site the list is on. That was done when I created it and selected to create unique permissions. I can create the "Me" filter, but the admin on the site would have to switch views every time they went on it. That also means that others could switch the view and see all the other items. Maybe I didn't follow you? Mar 11, 2013 at 15:00
0

It turns out the problem was that the default "members" group, created by SharePoint when creating the site, has "contribute" permissions. When you look at the contribute permissions, it has "Manage Lists" checked. Item-level security ignores users with manage list permissions. I copied the Contribute permissions to a new permission level and took off the manage lists and all other things I didn't need. Then, I created a group with the new permission level and added users. Now it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.