0

I'm very new to SharePoint 2010, and I've been working on a workflow for folder permissions that replaces all permissions so that only a certain group is given Contribute access to the folder. This seems to work as it should - users who aren't in that certain group seem to be given Limited Access as a default, and so can't see the folder when they enter the document library.

However, the problem is that when they access the folder through a direct URL, they're able to see the folder instead of getting "Access Denied".

Additionally, in the workflow, I also have it set so that non-Folder items inherit permissions from the folder. When users who aren't in the group type in the URL to these documents within the folders, they're correctly shown "Access Denied".

So the permissions seem to work correctly for documents within the folders (so that they're inaccessible even with a direct URL), but somehow a user who shouldn't have permission is able to access the folders themselves with a direct URL (so they see the folder itself, but not the contents within). I've tried removing the groups with Limited Access entirely so that the user's "check permissions" for the folder is none, but they're still able to access it through URL.

Any advice? I'm pretty confused as to why this is happening, and how I can fix it.

0

If you really dont want Limited access feature in your site, deactivate the Limited-access user permission lockdown mode feature. And check if you still face that issue.

  • Would deactivating that require admin access? I'm looking under site settings and I don't see that feature there (I only have Full Control access). – user56551 Jun 28 '16 at 13:38
  • Go to Root Site Collection > Site Settings – Nagarajan Muthukumar Jun 28 '16 at 13:42
  • The lockdown mode feature is only available in the UI in 2013, in 2010 it has to be initiated on the server. – Eric Alexander Jun 28 '16 at 13:42
  • I guess I'll let the site owner know about that option. I'm not sure if it would fix my problem though, because I've removed groups that the user was in that allowed them to have Limited Access to the folder (so checking the user's permissions for the folder returned "none"), but somehow they were still able to open the folder using the URL anyway. – user56551 Jun 28 '16 at 14:19
0

I tried asking around in other forums, and was told that this happens with folders by design, and using document sets instead would be a good workaround. The document sets seem to be working so far, so I think that's what I'll use. Thanks for everyone's help!

Source: https://social.msdn.microsoft.com/Forums/sharepoint/en-US/3ebdb5e2-5d42-4817-a779-ad575407503e/sharepoint-folders-with-unique-permissions-accessible-via-url?forum=sharepointgeneralprevious&prof=required

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.