I have SharePoint 2010 Foundation with a site collection for one business organization. Within that collection I have a lot of subsites. I would like to restrict members of one subsite from browsing user accounts in the people picker to only users within that subsite.

I have configured the option to only search within the site collection but need to increase that a level into the subsite.

I'm looking for suggestions on how to achieve this. Ideally I would like something that is low overhead. I looked at using AD read permissions to handle which accounts the logged in user is able to view but it was going to be a lot of overhead and complexity I would like to avoid.

Alternatively if there is a suggested way to remove/disable People picker from every possible area on the sub-site I would consider that as a solution.

TIA -Michael


I can't think of a way to filter the people-picker dataset beyond a site collection and I'm not aware of any site-level configuration you can set or command you can invoke to disable/remove it.

And from a run-time perspective it's renders pretty ugly mess of HTML, so you can't simply disable/remove it...and even if you could I'm not sure where you'd put it. I guess you could come come up with a custom master page with some javascript or jquery in it that renders the control disabled, hidden, or gone altogether...you could look at the SPUtility project on CodePlex for some ideas: http://sputility.codeplex.com

Alternately, and again theoretically because I've never tried this myself, you could put some logic in a hidden web part that finds and alters the rendering behavior of the people-picker controls and embed that web part in a custom masterpage that is used by the pages in the site.

Any way you look at it, a lot of work. What problem(s)/issue(s) are you trying to prevent by doing this? Maybe someone can offer an alternate approach.

  • Trying to preserve confidentaility of the users in the site collection. Site A shouldn't be able find out that John Doe is also one one of the sites in the collection. – Michael Aug 23 '11 at 20:26
  • 1
    Is there a regulation (i.e. HIPAA) driving this or is this just a requirement coming from the business? I ask because I honestly don't know what harm could come from me knowing that you have access to one or more sites in a site collection. – Rob D'Oria Aug 23 '11 at 20:32
  • 1
    If that's the case, then the sites should be spun off as their own site collections. This will make it easier to maintain permissions and "breach" of data. – Eric Alexander Aug 24 '11 at 0:57

You can create a group for that subsite, add users to it and then assign this group to your people picker column. This will bring the users only from that group

  • You can write job that populates this group with all users in the SPWeb.Users collection. – Jimbo Alba Oct 28 '11 at 17:33

You could create a custom user permission that disables Browse User Information and apply that as needed.

  • I'll give that a try and see if it will impact other use of the site. I did a search on that permission and found someone reported specifically that they couldn't use the people picker, the fix they implemented was granting Browse User Info. I'll just do the opposite. directsharepoint.com/2011/04/… – Michael Aug 23 '11 at 21:14

IF your requirement is that people should not know who are a member of that site also, you should IMHO move to site collections. A site collection is the most scalable thing in SP (you can move it as a whole for instance) and it is the first real (hard) security barrier a user encounters (or a dev for that matter in code). And look at the name: site collection. It implies that is a collection of related sites, so members should also have some relation. If they don't they should be in a separate SC (and maybe a shared portal they can all access and through which they can get to their respective SC's). Just put up a webpart that shows the SC's you can access:



To continue on @Paddy 's thoughts, you can write job that populates this group with all users in the SPWeb.Users collection.

using (SPSite site = new SPSite("http://sharepoint"))
    SPWebCollection allWebs = site.AllWebs;

    foreach (SPWeb web in allWebs)
        SPUserCollection allUsers = web.Users;
        foreach (SPUser user in allUsers)
             //Add this user to the current site's all users group.

  • Make sure you dispose the SPWeb instance, too, before the end of the first foreach. – James Love Oct 28 '11 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.