I want to be able to give user John Doe full permissions to a site, but I want to give the same user read-only permissions (or perhaps none at all) to a specific document library that resides within that site.

Is this possible? If so, how do I go about setting this up?


After a bit of comment discussion, I think we've nailed it down.

Permissions trickle down in Sharepoint. You have web application permissions in Central Administration (Application Management -> Policy for web application) to deal with that grant permissions to users globally for the web application.

The next set of permissions down would be site collection owner/site collection administrator. If a user is a SCO/SCA, they'll have access to everything in the site collection whether or not they've been granted permissions.

Then you have site permissions, either by a Sharepoint group or explicitly added.

If you remove John Doe from the web application policy and he is not listed as a SCO/SCA, he will not have access to the document library if his Sharepoint group has been removed from the access list.

| improve this answer | |

Go to the settings on the document library and you should see a link for Permissions. You can set his permissions there. You can also set it at the document level if you really want to go that far, but that would not be recommended as it gets hard to maintain security when you have permissions that granular.

Granting/denying permissions to individual users is not really a best practice. You should create a group called something like "restricted readers" and then set permissions for that group in the list. This allows you to easily add/remove others who may also have this same restriction down the road without having to figure out all of the places where you have set permissions.

| improve this answer | |
  • I've done this, and for some reason granting John Doe full access to the site overrides any permissions listed specifically for the library. Also, I understand it isn't best practice, but grating individuals explicit permissions is more conducive for the way my site collection is structured. – newuser Apr 21 '11 at 14:25
  • Is John Doe listed as a site owner in central admin or has he been added to the site collection administrators in the Site Settings? – Eric Alexander Apr 21 '11 at 14:30
  • Is this user also in a group that has higher permissions on the same list? If so, the higher permissions apply. – Dave Wise Apr 21 '11 at 14:38
  • @PirateEric - No and no, and yet John Doe can still see a link in the Quick Launch to a library for which he has no permissions, open said library and view the file names, and open documents within said library and edit them. – newuser Apr 21 '11 at 15:00
  • @Dave Wise - No, John Doe isn't in a group with higher permissions. – newuser Apr 21 '11 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.