1

The site setup goes like this. Top site ---> Subsite1--->Subsite1.1

Subsite1 is inheriting permissions from top site. Unique permissions are set for Subsite1.1 and due to that users on Subsite1.1 have "None" permissions on Subsite1 and Top site.

Now the problem is that the users of subsite 1.1 are not able to access this site. Whenever they try to access subsite 1.1, they get access denied error. I checked and it seems no unique permissions are set for Site Pages library or home.aspx. Whenever they are added to top site permissions , then only they are able to access subsite 1.1 which is not I want.

SharePoint 2013 is being used. Kindly help.

|improve this question
2

As the users of your Subsite1.1 have no permissions to Subsite1, they also don't have permissions to the Top site (<=> Top site's permissions are inherited to Subsite1). Because of this, your users also have no permissions to files essential to the site collection's system, which are hosted at the Top site level.

As discussed e.g. here, the users of your Subsite1.1-level need to be at least members of the Style Resource Readers permission group, which grants them sufficient rights to access the system files, but no more than that.

Also quoting myself from the other thread:

Slightly offtopic, but a rule of thumb when designing a site collection is to consider the user groups that should access the particular site. It's always recommended to have a top-to-down architecture, where users always have permissions to the parent site of a subsite.

|improve this answer
  • Would the users be able to access the contents of top site if I provide them read permission on Style Resource Readers group? Also, is Read permission on Style Resource Readers group enough for them to access subsite 1.1 ? – Prabhat Singh Jun 22 '17 at 11:43
  • @PrabhatSingh you only need to add the users to the site permission group, SharePoint will handle the rest. Also no, the users will not get access to actually visit the Top site's pages, so there's no need to worry about that. Also as Achiever SP suggested, it's recommended to handle these users by using an AD group so you don't have to manually update the users of Style Resource Readers. Additionally you could add Everyone or NT Authority\authenticated users or other built-in group to the Style Resource Readers. If the users of Subsite1.1 are externals, then Everyone will be ok. – moe Jun 22 '17 at 11:52
0

I agree with MOE. Also, once you break the permissions, the SharePoint groups from top level site still exists. After you break the permissions, you should remove those groups and add the users manually to other (AD Groups - Preferred) to that site alone.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.