SharePoint 2010 - Restrict access to 1 folder, Access Denied

Question

We have a SharePoint 2010 environment that is quite mature and the permissions are all well established.

I have had a request to restrict access to a Folder within a Document Library. Users with permissions to the folder and documents within must not be allowed to see the site or the Document Library.

So the folder has unique permissions and any user given access to the folder gets Limited Access to the Site and Document Library.

However, when I provide a link to a document in the Folder to a user with Permissions to the Folder they are getting Access Denied.

I have replicated this issue on a Test environment and it works as I expect it to so I am thinking it must be either a Site Setting or a Library Setting.

I have tried the following to try and resolve :-

1. Checked for Site Features such as Limited Access Lockdown (which I think is SP2013) or Restrict Limited Access Permissions
2. Checked for ViewFormPagesLockDown feature
3. No Versioning set on the library

Anywhere else I can check would be greatly appreciated or alternatively if you could point out what I've done wrong, please do.

Thanks

Dan

Answer 1

Since you have deactivated the feature after granting access at folder level, limited access is not promoted at library level.

To correct this I suggest you to use Power Shell. Now you can't add Limited Access to a user directly, but you can add it to a group. So I would suggest something like this:

1. Add the group to SharePoint, but do not select a permission level
2. Place the users within you need to have limited access

3. Run the following PowerShell Commands to add the Limited Access:

    $spGroup = $spWeb.SiteGroups["Limited Access Group"]; 
    $spWeb.RoleAssignments.Add($spGroup);
   

Take special note I am using SiteGroups and not Groups, because the group hasn't been added to the site yet roles yet. The next command will do that though. You will not see the group in the GUI but if you check the group by running:

    $spWeb.Groups["Limited Access Group"];

You will see the role {Limited Access} has been added. Everything should be good after that.