As per a new security standard implemented by my organization I need to restrict access to the /_layouts/15/_vti_bin/lists.asmx for both authenticated as well as anonymous users.

I am thinking of restricting "everything" that is inside the folder _vti_bin. If I do that, will there be any problem in normal functioning of SharePoint 2013? I have few custom webparts that uses REST webservice but none of them use lists.asmx.

Note: Due to some reason I couldn't use the method "<location>...</location> " in web.config as recomended by Microsoft. So I am using the approach mentioned in this SE post (the one marked as answer).

  • It looks like it will affect the native features of SharePoint. When I deployed my HttpModule the initial observation is the problem with list forms and quick edit view. I think is it is a "no-go".
    – Arun
    Commented Jan 15, 2016 at 9:58
  • Even though SharePoint allows to read WSDL, it will not let the users fetch the list contents if the end user is not permitted. Is this correct?
    – Arun
    Commented Jan 15, 2016 at 10:00
  • For the time being I just disabled anonymous access to "_vti_bin" because in my site anonymous users are presented with only few static article pages. For authenticated access I all disabled "lists.asmx" file.
    – Arun
    Commented Jan 15, 2016 at 12:17
  • My attempt to disable access to "_vti_bin" was a failure. It should not be done in that way, as Trevor mentioned below.
    – Arun
    Commented Jan 20, 2016 at 5:51

2 Answers 2


This simply isn't supported. SharePoint needs to be able to make those calls as well, e.g. PowerPivot (call is translated from NT AUTHORITY\ANONYMOUS to the target caller). You will just need to communicate this to your security folks.


did you tried adding authorization rule in web.config file. eg. for specific sitecollection

<location path="sub-site/_vti_bin">
       <deny users= "?" />
       <allow users = ”*” />

refer below link for further details : http://thuansoldier.net/?p=4267

  • "Note: Due to some reason I couldn't use the method "<location>...</location> " in web.config as recomended by Microsoft" - quote from question Commented Jan 15, 2016 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.