We've been running into a bizarre scenario and I'm at a complete loss.
I'm a site collection admin for my division's portal. We're on a shared internal company-wide MOSS server, and I have no access to Central Admin or the WFEs.
This issue is happening to at least two separate people. It's been happening over the course of the past few months intermittently, and at the beginning I thought it was "user error."
These two people are completely unrelated other than working within the same division for their own respective teams. They're not even in the same state as each other, or as myself for that matter. Only other similarity - they're both members of their own respective team's site owners groups.
Randomly, these users simply disappear from their respective site's SharePoint user groups.
This has now happened at least 4 or 5 times over the past 3 months or so. At the first report of this issue, I had assumed that another "owner" had removed them. Then a couple of days later, the other person reported the same thing.
Access is granted on this portal for the most part, and in these cases, via adding user accounts directly to SharePoint groups. They're both members of SharePoint groups that have only a handful of members. They have completely different members as well - no overlap within the groups. There are only 2 site collection administrators: myself and my boss - and I know that my boss is not modifying permissions on the portal. There are a small handful of upper management that have enough access to remove these users, but they request that I handle the permissions adjustments for them. The likelihood that there is someone going through these particular user groups and removing these specific people is very, very low.
I've checked with the SharePoint server admins. They report that there are no timer jobs that would be having any impact, and they say that they haven't found anything in the logs. There's nothing that they're aware of that would cause anything like this. I'm looking through the site collection audit logs now, and so far have found nothing.
One of the people reported that they had lost access today, and gave me a relatively accurate time of when it happened. I checked the owners group, and sure enough, they had disappeared again. I readded them only to find that 10-15 minutes later they were gone again!
When the first user reported the issue, I checked the second person's access and their account was gone too. I added the second user back, and that account actually stayed within the group...
So this doesn't appear to be an exact one-to-one. They don't lose access at the same time, every time.
The last time that this happened, it was only the second person that reported it. I was suspicious of the actual SharePoint groups - maybe something buggy with those particular groups?? I was grasping at straws. So I created a NEW group, and added the second user's account to that group in addition to their normal owners group. I set myself as the owner of that group, and only I could modify membership. When I checked the account today, his account was removed from BOTH groups.
I think the portal is haunted? I really don't have a better explannation. Has anyone else even heard of anything remotely close to this?
Update (May 11): We have confirmed that there are no logs that indicate that this is something that any individual user(s) is responsible for this. I've escalated this up to our server admins who have not yet determined the cause, and they're contacting Microsoft.
Update (May 24): We've found another user that is experiencing this. She's a member of another completely separate site's contributors group. We continue to check the permissions & review the logs, though we have yet to find any evidence in any logs of this happening. Microsoft has asked that we provide proof - which we are unable to collect unless it's a screenshot of the permissions before & after. I've also tested adding users directly to the SharePoint permissions in addition to the user groups - & both are revoked at the same time. We're now investigating Active Directory.
Update (June 10): We have been able reliably reproduce it by using the "includeusersecurity" flag for site exports from our WSS 2.0 > MOSS 2007 site upgrades/migrations. When we import the sites into our portal using exports that used that flag, once the restore of the .cmp file(s) begins we can literally watch the users' permissions disappear - one user at a time. I don't believe that this is the only cause because the users have experienced this issue during periods of time when there have not been imports for weeks. Meanwhile, this appears to have stumped Microsoft. We've been testing with them, but they still do not have any answers or ideas.
Update (June 23): Continuing to work with Microsoft. After numerous tests and several troubleshooting sessions, they believe that this may be an issue with AD.