How do permission levels work? I don't know why I have "access denied" every time I access a subsite even if I have read permission. I am hopeful that somebody will shed light on this.

Here's the scenario:

Intranet (parent site)
|- Intranet Owners (Administrator)
|- Intranet Members (User1, User2)
|- Intranet Visitors (GUser1, GUser2)
|- HR Members (User1) // Contribute permission
|- Corporate Communications Members (User1,User2) // Contribute permission
|- IT Members (GUser1, GUser2) // Contribute permission

Subsites will be the departments:
|- HR (default group - HR Members)
|- Corporate Communications (default group - Corporate Communications Members)
|- IT (default group - IT Members)

Here's the question:
Can GUser1 access the Corporate Communications site? GUser1 has read permission on the site collection level. This is the problem I'm facing right now. I logged in as GUser1 and got an "Access Denied" error. Why?

  • Did you break permission inheritance on the Corp. Communications site?
    – AlexPoint
    Sep 6, 2011 at 7:30
  • I think I did just that. Is this the reason why I got "Access Denied" error? Does the site's permission setting supersedes that of its parent's? Sep 6, 2011 at 8:07
  • From remote, it's hard to say what has happen in detail. Does the error persists if you switch inheritance back on?
    – AlexPoint
    Sep 6, 2011 at 8:51
  • Yes I still have the error after switching back the inheritance. But if GUser1 is added in Intranet Members group, GUser1 can access Corporate Comms' site. If GUser1 is a member of Intranet Visitors, should he be allowed to view the site? That's only read access, I can't understand why GUser1 is denied access. Sep 6, 2011 at 9:41
  • Is it a subsite or site collection, if the departments are sitecollection you may face problems like this in permissions
    – Strider
    Sep 6, 2011 at 10:57

1 Answer 1


If you're saying that GUser1 has Read permission at the site collection level, depending on how the subsite was created, they might not have access to the communications site. Check the permissions for corporate to ensure the Intranet Visitors group has read permission. By the way you have spelled it out, it does not appear that Guser1 will have access because he is not listed in the Corp Comm users group and you haven't listed Intranet Visitors as having access to the Corp Comm subsite.

Just because a group as permission at the root of a site, it does not mean that it trckles down to everywhere in the collection. If subsites are created with custom permissions, then yhe permissions inheritance is broken from it's parent, and any groups that exist at the parent need to be explicitly added to the subsite.

  • Ok got it. But if I set a default group for the corporate communications website, call it CC Members, the site has unique permissions and explicitly add GUser1 as user with read permission to the site, still got "Access Denied" error. Why? Sep 7, 2011 at 8:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.