User Accounts Disappearing From SP Groups

Question

We've been running into a bizarre scenario and I'm at a complete loss.

I'm a site collection admin for my division's portal. We're on a shared internal company-wide MOSS server, and I have no access to Central Admin or the WFEs.

This issue is happening to at least two separate people. It's been happening over the course of the past few months intermittently, and at the beginning I thought it was "user error."

These two people are completely unrelated other than working within the same division for their own respective teams. They're not even in the same state as each other, or as myself for that matter. Only other similarity - they're both members of their own respective team's site owners groups.

Randomly, these users simply disappear from their respective site's SharePoint user groups.

This has now happened at least 4 or 5 times over the past 3 months or so. At the first report of this issue, I had assumed that another "owner" had removed them. Then a couple of days later, the other person reported the same thing.

Access is granted on this portal for the most part, and in these cases, via adding user accounts directly to SharePoint groups. They're both members of SharePoint groups that have only a handful of members. They have completely different members as well - no overlap within the groups. There are only 2 site collection administrators: myself and my boss - and I know that my boss is not modifying permissions on the portal. There are a small handful of upper management that have enough access to remove these users, but they request that I handle the permissions adjustments for them. The likelihood that there is someone going through these particular user groups and removing these specific people is very, very low.

I've checked with the SharePoint server admins. They report that there are no timer jobs that would be having any impact, and they say that they haven't found anything in the logs. There's nothing that they're aware of that would cause anything like this. I'm looking through the site collection audit logs now, and so far have found nothing.

One of the people reported that they had lost access today, and gave me a relatively accurate time of when it happened. I checked the owners group, and sure enough, they had disappeared again. I readded them only to find that 10-15 minutes later they were gone again!

When the first user reported the issue, I checked the second person's access and their account was gone too. I added the second user back, and that account actually stayed within the group...

So this doesn't appear to be an exact one-to-one. They don't lose access at the same time, every time.

The last time that this happened, it was only the second person that reported it. I was suspicious of the actual SharePoint groups - maybe something buggy with those particular groups?? I was grasping at straws. So I created a NEW group, and added the second user's account to that group in addition to their normal owners group. I set myself as the owner of that group, and only I could modify membership. When I checked the account today, his account was removed from BOTH groups.

I think the portal is haunted? I really don't have a better explannation. Has anyone else even heard of anything remotely close to this?

Update (May 11): We have confirmed that there are no logs that indicate that this is something that any individual user(s) is responsible for this. I've escalated this up to our server admins who have not yet determined the cause, and they're contacting Microsoft.

Update (May 24): We've found another user that is experiencing this. She's a member of another completely separate site's contributors group. We continue to check the permissions & review the logs, though we have yet to find any evidence in any logs of this happening. Microsoft has asked that we provide proof - which we are unable to collect unless it's a screenshot of the permissions before & after. I've also tested adding users directly to the SharePoint permissions in addition to the user groups - & both are revoked at the same time. We're now investigating Active Directory.

Update (June 10): We have been able reliably reproduce it by using the "includeusersecurity" flag for site exports from our WSS 2.0 > MOSS 2007 site upgrades/migrations. When we import the sites into our portal using exports that used that flag, once the restore of the .cmp file(s) begins we can literally watch the users' permissions disappear - one user at a time. I don't believe that this is the only cause because the users have experienced this issue during periods of time when there have not been imports for weeks. Meanwhile, this appears to have stumped Microsoft. We've been testing with them, but they still do not have any answers or ideas.

Update (June 23): Continuing to work with Microsoft. After numerous tests and several troubleshooting sessions, they believe that this may be an issue with AD.

Answer 1

It sounds very much like you are locking horns with someone 'cleaning up' security on their subsite without an understanding of how People and Groups work in SharePoint. Enable your auditing and security logs and then look through them when these people disappear from their groups. That should tell you exactly who is removing them.

Answer 2

We have the same issue here. What recently happened is that my direct colleague has asked me to export a site with the -STADM command option -includesecurity.

What happened is that he was disappeared from his own page ownership. Í guess it has to do with the –includesecurity

Answer 3

We had this identical problem in 2011. After much troublehooting and Fiddler traces sent to Microsoft, they finally sent someone on-site. Microsoft's diagnosis was that because we set permissions via pulling in AD accounts into SharePoint groups and b/c we are using ADFS; ADFS was the root cause.

SCENARIO: When it times out during login, the ADFS agent creates a phony SID in order to construct a valid token and passes that along to SharePoint. SharePoint in turn sees that as a different user the first time it occurs and automatically creates a new user entry in the SP database. The catch comes when you try to log in the next time and randomly get the wrong table entry. That’s when all the fun begins.

MICROSOFT's FIX: Use AD security groups for permissioning. While this remedy has seemed to fix the problem it did prohibit the use of alerts b/c individual accounts were no longer being used.

Answer 4

I found something that is related, but still doesn't explain the "disappearing" users, which we have also experienced in SP2010.

http://blogs.architectingconnectedsystems.com/blogs/cjg/archive/2012/05/10/HUGE-Permissions-bug-with-Import_2D00_SPWeb-_2D00_includeusersecurity.aspx

Answer 5

@Loki

Same issue here. I restored some subsite under /sitedirectory using the stsadm -includeusersecurity parameter. (stsadm -o import -url http://ourpoortal.com/sitedirectory/somesubsite -filename d:\somefolder\filename.exp -includeusersecurity -versions 4) We don't use inheritance under /Sitedirectory so all subsites have explicit permissions. Permisisons on the restored site seemed well.

Later several users claimed they lost access to another subsite. A complete different one than the one I imported. Indeed the user account didn't appear in any of the sites I checked. I assumed someone removed the user from this (sub)site.

Not yet proven it's an AD issue but after reading this I really fear that importing one site and using the -includeusersecurity parameter messed up permissions for all other subsites below the same Sitedirectory. I checked the All People group and did find several old user accounts.

Very scary indeed !