5

We've been running into a bizarre scenario and I'm at a complete loss.

I'm a site collection admin for my division's portal. We're on a shared internal company-wide MOSS server, and I have no access to Central Admin or the WFEs.

This issue is happening to at least two separate people. It's been happening over the course of the past few months intermittently, and at the beginning I thought it was "user error."

These two people are completely unrelated other than working within the same division for their own respective teams. They're not even in the same state as each other, or as myself for that matter. Only other similarity - they're both members of their own respective team's site owners groups.

Randomly, these users simply disappear from their respective site's SharePoint user groups.

This has now happened at least 4 or 5 times over the past 3 months or so. At the first report of this issue, I had assumed that another "owner" had removed them. Then a couple of days later, the other person reported the same thing.

Access is granted on this portal for the most part, and in these cases, via adding user accounts directly to SharePoint groups. They're both members of SharePoint groups that have only a handful of members. They have completely different members as well - no overlap within the groups. There are only 2 site collection administrators: myself and my boss - and I know that my boss is not modifying permissions on the portal. There are a small handful of upper management that have enough access to remove these users, but they request that I handle the permissions adjustments for them. The likelihood that there is someone going through these particular user groups and removing these specific people is very, very low.

I've checked with the SharePoint server admins. They report that there are no timer jobs that would be having any impact, and they say that they haven't found anything in the logs. There's nothing that they're aware of that would cause anything like this. I'm looking through the site collection audit logs now, and so far have found nothing.

One of the people reported that they had lost access today, and gave me a relatively accurate time of when it happened. I checked the owners group, and sure enough, they had disappeared again. I readded them only to find that 10-15 minutes later they were gone again!

When the first user reported the issue, I checked the second person's access and their account was gone too. I added the second user back, and that account actually stayed within the group...

So this doesn't appear to be an exact one-to-one. They don't lose access at the same time, every time.

The last time that this happened, it was only the second person that reported it. I was suspicious of the actual SharePoint groups - maybe something buggy with those particular groups?? I was grasping at straws. So I created a NEW group, and added the second user's account to that group in addition to their normal owners group. I set myself as the owner of that group, and only I could modify membership. When I checked the account today, his account was removed from BOTH groups.

I think the portal is haunted? I really don't have a better explannation. Has anyone else even heard of anything remotely close to this?

Update (May 11): We have confirmed that there are no logs that indicate that this is something that any individual user(s) is responsible for this. I've escalated this up to our server admins who have not yet determined the cause, and they're contacting Microsoft.

Update (May 24): We've found another user that is experiencing this. She's a member of another completely separate site's contributors group. We continue to check the permissions & review the logs, though we have yet to find any evidence in any logs of this happening. Microsoft has asked that we provide proof - which we are unable to collect unless it's a screenshot of the permissions before & after. I've also tested adding users directly to the SharePoint permissions in addition to the user groups - & both are revoked at the same time. We're now investigating Active Directory.

Update (June 10): We have been able reliably reproduce it by using the "includeusersecurity" flag for site exports from our WSS 2.0 > MOSS 2007 site upgrades/migrations. When we import the sites into our portal using exports that used that flag, once the restore of the .cmp file(s) begins we can literally watch the users' permissions disappear - one user at a time. I don't believe that this is the only cause because the users have experienced this issue during periods of time when there have not been imports for weeks. Meanwhile, this appears to have stumped Microsoft. We've been testing with them, but they still do not have any answers or ideas.

Update (June 23): Continuing to work with Microsoft. After numerous tests and several troubleshooting sessions, they believe that this may be an issue with AD.

5
  • I am having the same issue. Today, all of my security groups for a site were emptied, EXCEPT the Owner's group. I added a security/distribution group to the Members security group and everyone was able to get back into the site. Later today a different site, on the same SP2010 server stopped allowing certain people into the site. Even though they were still listed in the security groups with Contributor access. I applied to 2 August CU's a while back. There have been no other Windows Updates installed. Any ideas what to look at? I looked in the 14 folder logs and don't see anything related to
    – user3350
    May 10, 2011 at 20:44
  • We are facing nearly the same problem in a SharePoint 2007 farm. Did your case came to any solution?
    – user6707
    Feb 2, 2012 at 17:11
  • I've had similar reports but assumed user error and moved on. Doesn't seem to happen here as frequently as it does for you (Maybe because we focus more on AD groups instead of individual users?) - Anything Ever Come of This? Feb 2, 2012 at 20:31
  • I escalated to Microsoft, and they were not able to find a solution. At this point I've given up. I've been performing my stsadm exports without including user security, and that seems to have minimized the recurrence.
    – elorg
    Mar 28, 2012 at 18:38
  • I'm having this problem in a SharePoint Online evnvirnoment. Certain users disappear from groups minutes after I added them.
    – Wout
    Jan 6, 2015 at 11:30

5 Answers 5

2

It sounds very much like you are locking horns with someone 'cleaning up' security on their subsite without an understanding of how People and Groups work in SharePoint. Enable your auditing and security logs and then look through them when these people disappear from their groups. That should tell you exactly who is removing them.

3
  • Unfortunately that does not appear to be the case as I had stated in my post. I've been reviewing the logs and there are no records of these people being removed from their user groups. In addition, one of the instances had the user account removed from a group that only I had the ability to modify the group membership. Side note: I do see in the logs where I've added them back.
    – elorg
    May 9, 2011 at 16:31
  • You might be surprised on how unrestricted that restricted group was. Just because the security list said that only you had permissions does not make it so. Site Collection Administrators would still have permissions. Also, any user/group added via Web Application Policy would also have permissions and neither of these would show in the UI as having permission. This latter approach is fairly common in Corporate deployments.
    – Dave Wise
    May 9, 2011 at 16:43
  • Right. As I stated in my question, I am 1 of 2 site collection admins. I am the primary point of contact for our division's site collection, so all support requests go through me. The corporate-level support group does not get involved in our site collection unless they receive a request from myself or my boss, so I'm fairly certain that no one has modified the user group that I locked down for testing that theory. Thank you for being thorough though.
    – elorg
    May 11, 2011 at 13:53
1

We have the same issue here. What recently happened is that my direct colleague has asked me to export a site with the -STADM command option -includesecurity.

What happened is that he was disappeared from his own page ownership. Í guess it has to do with the –includesecurity

1

We had this identical problem in 2011. After much troublehooting and Fiddler traces sent to Microsoft, they finally sent someone on-site. Microsoft's diagnosis was that because we set permissions via pulling in AD accounts into SharePoint groups and b/c we are using ADFS; ADFS was the root cause.

SCENARIO: When it times out during login, the ADFS agent creates a phony SID in order to construct a valid token and passes that along to SharePoint. SharePoint in turn sees that as a different user the first time it occurs and automatically creates a new user entry in the SP database. The catch comes when you try to log in the next time and randomly get the wrong table entry. That’s when all the fun begins.

MICROSOFT's FIX: Use AD security groups for permissioning. While this remedy has seemed to fix the problem it did prohibit the use of alerts b/c individual accounts were no longer being used.

0

I found something that is related, but still doesn't explain the "disappearing" users, which we have also experienced in SP2010.

http://blogs.architectingconnectedsystems.com/blogs/cjg/archive/2012/05/10/HUGE-Permissions-bug-with-Import_2D00_SPWeb-_2D00_includeusersecurity.aspx

1
  • This would make a better comment than an answer. Please make comments comments and answers answers in the future, this can affect the question openers acceptance score.
    – Hugh Wood
    Nov 20, 2012 at 10:18
0

@Loki

Same issue here. I restored some subsite under /sitedirectory using the stsadm -includeusersecurity parameter. (stsadm -o import -url http://ourpoortal.com/sitedirectory/somesubsite -filename d:\somefolder\filename.exp -includeusersecurity -versions 4) We don't use inheritance under /Sitedirectory so all subsites have explicit permissions. Permisisons on the restored site seemed well.

Later several users claimed they lost access to another subsite. A complete different one than the one I imported. Indeed the user account didn't appear in any of the sites I checked. I assumed someone removed the user from this (sub)site.

Not yet proven it's an AD issue but after reading this I really fear that importing one site and using the -includeusersecurity parameter messed up permissions for all other subsites below the same Sitedirectory. I checked the All People group and did find several old user accounts.

Very scary indeed !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.