We have a web application which is setup with policies to deny access to create/manage sites or manage permissions to all users in our company(using an AD group). But during an audit we found that some users had this access(they were part of the group for which the permission was denied).

Apparently an admin (not with us anymore) gave them access somehow. I'm trying to figure out how he was able to give them this access. I don't see the users (who have access) directly or as part of any other group in the user policy.

This is for sharepoint 2010, and I'm using central admin primarily. Anyway I can find out where these users are getting the access from?

1 Answer 1


There are ways, you could look at groups already (but always starting):

  1. Start from SP-CA have a look for the Web Application in cause in the User Policy see if any hard-coded permissions have been added.
  2. While still in SP-CA have a look at Site Collection Administrators groups for those site collections causing troubles.
  3. Descending then you have always the "Check Permissions" button available in Site Permissions, and then for each sub-container (Sub-Site, List/Library).

Otherwise you need to fallback to some automated tools - don't want to favor any providers, but simply google-it, shall get you some of those.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.