4

I've been tasked to be the admin of a SharePoint 2013 site that was created by someone who never completely implemented it. I'm wondering why every site, page, list, folder, document at every level is defaulted to being shared with "Lots of People". Is there a way to set the default sharing of items?

Ideally from a security stand point I would like to have anything that is initially created to be shared with the minimal number of people possible. Is this a permissions inheritance issue? And if so what level does it need to be corrected and how? Here is an image of my Logical Design in which 3 subsites reside under the 'Home Site'

Improve this question
0

3 Answers 3

Reset to default
3

Based on your diagram it looks like you are inheriting permissions from the top level site. If you build out a sub site in a site collection one of the options on creation is whether or not you want to use the same permissions groups from the parent site.

enter image description here

If you select Use unique permissions you will be able to create and define the members of those groups after the site is created. That is something to note going forward.

For sites that are already created, specifically in your case the Director Document site, you can go to the site permissions and stop inheriting permissions from the parent site. From here you can also see which site everything is being inherited from as well as if there are lists or libraries on your site that have their own unique permissions.

enter image description here

Improve this answer
2
  • I have stopped Inheriting Permissions and am using unique permissions as you indicated above. I can verify this because users that are "Members" can see the "Edit" button on the site level for their specified section. However, they do not see the "Edit" site button on any other pages. Users do have access to every other page, list, doc though. It seems they must be inheriting the "Visitor" permission with the ability to "Read" everything within the site. Referencing my pic above, is there a level above the "Home Site", perhaps the site collection or web application, with "read" permissions?
    – bogdan
    Apr 4, 2016 at 16:34
  • Referencing the second image of my answer, you can click Check Permissions from the site that they seem off on and see where a specific person is getting permissions from. It will list each group that they belong in and what permissions are given from them. Try using that to troubleshoot.
    – Jordan
    Apr 4, 2016 at 16:39
2

Sounds like you need to do an audit of the entire implementation. I'd sit down with users that are the owners of the data, or department head, etc. and get a good idea of who will be using the site. You can also do a little preliminary work and grab some AD groups to verify that everyone in that group will be using the site, so they won't have to list out everyone (HR Users, IT Users, etc.). I'd find where the top level of the "lots of users" is and remove it. Make sure you set up the access request email for each site afterwards, and that way if users need to get access, they can fill out a form to do so.

Improve this answer
4
  • Referencing the logical design above, at the "Home Site" level, I actually took out the "Member" and "Visitor" groups. There's only the Website admins listed as "Owners", yet users are still able to see all subsites, lists, etc. Is there a higher level that I have to change? At the Web Application perhaps? I would like the users that do not have access to have to fill out the form to request access.
    – bogdan
    Apr 4, 2016 at 16:23
  • there is a "User Policy" in central administration that allows for permissions on a web application level, but that is more for administrators or service accounts, but you could check. Central Admin -> Manage Web Applications -> Highlight the web application -> User Policy
    – Mike
    Apr 6, 2016 at 13:01
  • The User Policy was actually the issue. The initial set up had all domain users with a "Full Read" Permission. So even at lower levels where users weren't given access to, they automatically had inherited the ability to read everything.
    – bogdan
    Apr 6, 2016 at 15:05
  • Good to hear! Make sure your users can get to the pages they need to and add them back to the Style Resources Readers if they have been removed
    – Mike
    Apr 6, 2016 at 15:38
1

With a combination of help from the answers from @Mike and @Jordan, I was able to resolve this issue. The "Lots of People" is coming from the highest level of permission inheritance. I figured this but didn't know how to configure that highest level.

Using the "Check Permission" on a specific site, I could see that users "None" listed as the Permission level given still had "factors that affected their level of access.

Check Permission Screenshot

Website Policy Menu Items Screenshot

In the Central Administration of SharePoint and clicking Application Management > Manage Web Applications > [selecting the name of the website] > User Policy, I could see all "domain users" Permissions were set to Full Read. (This is why users could see subsites that they weren't given access to.)

Policy For Web Application Screenshot

Closing the User Policy window and going to the Permission Policy menu item, I created a new permission Policy Level that only allowed View Pages and Open permissions under the Site Permissions category.

I then went back to the User Policy settings and set all "domain users" to this new Permission Policy Level.

This along with the setting each subsite members to their appropriate Active Directory groups, allowed users into the top level Site Home and their appropriate section's subsite.

Sites and documents shared, by default, still do say "Lots of People" but those "Lots of People" are people in a specified group, not all domain users as before making these changes.

By going to Site Settings > Site Permissions > Access Request Settings and Allowing access request to an appropriate email address, access requests can now be made to other subsites to which users aren't originally assigned.

Thank you for everyone's help!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.