What I have?

I have a SharePoint 2010 web application with FBA configured and it is exposed to Internet. The root site collection has a huge hierarchy and each site has document libraries with many documents.

There are more than 10 site groups defined and some of them has access only to some sites.

What problem am I facing?

Everything was working fine and suddenly I am facing a problem in Enterprise Search.

When a user searches, the search result displays everything (including the site where user does not have permission) and clicking on a result it either opens the item (page/document) or shows Access denied error depending on whether the user has permission on that item.

Can someone tell me why is this happening?

  • have you found a soluton for this problem? We are having the same problem with our environment with Enterprise search. Permissions seems to be right and also search scopes but still users gets search results from sites they don't have permissions to.
    – user10400
    Commented Aug 29, 2012 at 13:21
  • No :( This error is still there on the site.
    – Vijay
    Commented Sep 13, 2012 at 7:08
  • Are you using standard SP Search or you are querying from your code?
    – user13559
    Commented Dec 11, 2012 at 15:22
  • It is standard SP Search. No other customization.
    – Vijay
    Commented Mar 30, 2013 at 17:13

2 Answers 2


We finally figured out the problem with this one.

We had given Full Read permissions to NT AUTHORITY\Authenticated Users for All zones in User Policy of the web applications in question. I am not sure of the reason for giving this. We removed it. Then, a full crawl fixed the issue.


  • Only the Search CRAWL Account should ever be configured in the User Policy section. This is to enable the Crawler account to be able to crawl content. Good catch!
    – Fox
    Commented Sep 10, 2013 at 8:08

I haven't had to use this myself, but I've read about similar problems. Posts like this one address how to customize security trimming of searches. Theoretically it's supposed to do that OOB but apparently that's not the case in some deployments, as seen here.

If you try to implement that, please post results here to help others out, because it's not an uncommon problem.


Not the answer you're looking for? Browse other questions tagged or ask your own question.