I have a SharePoint 2013 (Foundation) Site Collection with a Team Site at its Root.

My "power" users want to provision Sub Sites for collaborations but want the members (who access via extranet using Windows Authentication) of these sub sites to ONLY have access to the Sub Sites they are directly given permission to.

I have broken permission inheritance for each sub site but it seems the only way Sub Site Members can get to these Sub Sites is if I add the Everyone user to the visitors group at the Root Team Site.

Is this normal?

2 Answers 2


When you create a subsite, it still inherited assets from the root level sites i.e pages, images, logo etc. SO if you add a user in the subsite but dont have the rights on the Asset library, site pages library, Style Library and images library then user will get access denied error.

In order to fix it, you need to add the user into those libraries which is not good.

I would highly recommend that add the NT AUTHORITY\authenticated users & if FBA then all FBA users into the following groups on the root level site collection.

  • Style Resource Readers
  • Restricted Readers
  • what does FBA mean?
    – Peter
    Jun 3, 2015 at 22:05
  • It is farm based authentication but you don't need it as u r using windows auth...
    – Waqas Sarwar MVP
    Jun 3, 2015 at 22:11
  • yes...i'm really just helping a friend here and I don't need it to be too complicated
    – Peter
    Jun 3, 2015 at 22:13
  • Then simply add nt auth in both groups n u all set.btw I m also here for help.. :)
    – Waqas Sarwar MVP
    Jun 3, 2015 at 22:29
  • Style Resource Readers and Restricted Readers are not available in People & Groups on my SharePoint 2013 Foundation Server
    – Peter
    Jun 4, 2015 at 0:52

There are few resources on Parent Site that require permission to access.

Try giving thoses users limited permission on Site Collection root.

  • What are those resources? Should I create a Root Site Group called Passthrough that has those limited permissions? Whare are the limited permissions?
    – Peter
    Jun 3, 2015 at 1:43
  • There is a style resource reader group.. for testing just add a user into that Jun 3, 2015 at 1:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.