I have created a Windows Application, which uses Client object model to access lists in a Sharepoint site(installed and configured on a separate server).

I have used the default credentials to access the site i.e. it uses the client's system login credentials(From where it is running) to access the Sharepoint site. Now I have the permission to access the site and therefore the application successfully retrieves the SP Lists and Libraries.

I have generated an exe file and distributed the same to another user, who is not having access the Sharepoint site. I am amazed to find the application still retrieves the SP Lists and Libraries, though it is running in a client's system who is not having the access.

Can anybody let me know what is issue, as I have been expecting an access denied message for the client who is not having the access to Sharepoint site.

  • 1
    Do you have read only or limited access assigned to 'Authenticated Users' on your site?
    – James Love
    Commented Dec 6, 2011 at 8:14
  • I am the site collection administrator. Please let me know, if I have place the code.
    – suryakiran
    Commented Dec 6, 2011 at 8:49
  • 1
    Please check does your web applications allow anonymous access? Commented Dec 6, 2011 at 9:22
  • No, Anonymous access is not allowed. We have tried of opening the Sharepoint site from the client's(for whom there is no access) browser and it is asking for credentials and when the system credentials are provided access denied message is shown, but the windows application is running successfully.
    – suryakiran
    Commented Dec 6, 2011 at 9:40

1 Answer 1


Thank you James Love. You have given me the solution. We are having a Sharepoint Group called Style Resource Readers for which all the Network users are given the permission of limited access. I have removed the user group called NT AUTHORITY\authenticated users from that. Now the application is working as expected.

Check permissions from the ribbon has helped me lot on this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.