1

I am working on a sharepoint server 2013, and inside it i create a team site collection with a Discussion Board list on its main page. now i am trying to define the following 2 requirments:-

  1. to allow all our employees to have Read permission on the site collection, and hence to the discussion board list.

  2. when a new discussion is added to send an email to all our employees , with a link to the new discussion item.

now what i did is as follow:-

  1. Site Settings >> Site Permission >> I add Everyone to the "Intranet Visitors"

enter image description here

  1. now this covers the first requirement, where all our employees had a Read permission on the site collection.

  2. but when i create a workflow 2010 inside sharepoint designer 2013 and i add an activity to send an email to the "Intranet Visitors" group when a new discussion item is created, no email is being send

enter image description here

  1. i think that the problem is that Everyone does not have an email address assigned to it.

  2. so i search for an AD group named "AllOurStaff" which have an email as follow "allourstaff@XXXXX.net". now adding this AD group will allow me to send an email to all employees + all users will be granted Read permission on the site collection (even when i remove the Everyone from the Visitors group)..

but the only issue i am afraid of is that if i completely rely on the AD group to grant access + send emails, is that this AD group might be removed (for a reason or accidentally by IT admins), and if this happens then users will not be able to access the site collection..

so i ended up adding these inside the visitors group:-

  1. Everyone
  2. the AD group which contain all our employees.

enter image description here

so in this case i can send an email to all-users (through the AD group), and if the IT admin remove the AD group then our users can still access the site through the Everyone. so can anyone adivce if my appraoch of adding two users (Everyone + Ad group) a valid approach or it can cause issue i am unaware of ?

3
+50

There is a property IsHiddenInUI but unfortunately its only a getter property so you cant change its value and hide group in UI.

Now you are afraid that AD group might be removed by some adventurous IT admin, one approach I can think of would be to make a service account as owner of group and specify that only the owner can add members AllowMembersEditMembership = false which will prevent IT admins from deleting the group.

So, you can remove 'Everyone' from visitor group since you mentioned that 'AllOurStaff' already contains all users.

So your overall approach looks correct, in my opinion. You just need to adjust the group settings.

  • thanks for the reply,, when i said i am afraid that IT admin remove the AD group, i mean remove it from the AD itself .. and if so then inside sharepoint it will be using a non-exsisitng AD group the "allourstaff@XXXXX.net" in my case.. hope this explain my question clearly .. – john Gu Jan 23 '17 at 10:59
  • Ohh , if its removed from AD , then the access would still be available via the Everyone group but then ofcourse the email wouldn't be sent to the group. So yes your approach looks good. – Gautam Sheth Jan 23 '17 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.