I have a SharePoint 2013 (Foundation) Site Collection with a Team Site at its Root.

My "power" users want to provision Sub Sites for collaborations but want the members (who access via extranet using Windows Authentication) of these sub sites to ONLY have access to the Sub Sites they are directly given permission to.

I have broken permission inheritance for each sub site but it seems the only way Sub Site Members can get to these Sub Sites is if I add the Everyone user to the visitors group at the Root Team Site.

Is this normal?


When you create a subsite, it still inherited assets from the root level sites i.e pages, images, logo etc. SO if you add a user in the subsite but dont have the rights on the Asset library, site pages library, Style Library and images library then user will get access denied error.

In order to fix it, you need to add the user into those libraries which is not good.

I would highly recommend that add the NT AUTHORITY\authenticated users & if FBA then all FBA users into the following groups on the root level site collection.

  • Style Resource Readers
  • Restricted Readers
  • what does FBA mean? – Peter Jun 3 '15 at 22:05
  • It is farm based authentication but you don't need it as u r using windows auth... – Waqas Sarwar MVP Jun 3 '15 at 22:11
  • yes...i'm really just helping a friend here and I don't need it to be too complicated – Peter Jun 3 '15 at 22:13
  • Then simply add nt auth in both groups n u all set.btw I m also here for help.. :) – Waqas Sarwar MVP Jun 3 '15 at 22:29
  • Style Resource Readers and Restricted Readers are not available in People & Groups on my SharePoint 2013 Foundation Server – Peter Jun 4 '15 at 0:52

There are few resources on Parent Site that require permission to access.

Try giving thoses users limited permission on Site Collection root.

  • What are those resources? Should I create a Root Site Group called Passthrough that has those limited permissions? Whare are the limited permissions? – Peter Jun 3 '15 at 1:43
  • There is a style resource reader group.. for testing just add a user into that – Amal Hashim Jun 3 '15 at 1:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.