I would like to create a rule in a search scope that will exclude any sites that a specific AD group has permissions to. We have some sites that broad AD groups (ie: authenticated users) have access to, but I do not want those sites in the search scope.

Is there any managed metadata property that would allow me to do this?

  • Why do these users have access in the first place? Sep 19, 2012 at 17:16
  • the scope I want to edit is use by a third party webpart that diplays a list of sites a user has access to. We would like some of the sites to not show up in this web part. I know i would be able to explicitly exclude said sites but i am looking for a way to exclude general information sites that all users have access to from showing. the common bond between these sites currently and in the future would be the the broad AD groups.
    – Bob Klimes
    Sep 19, 2012 at 20:00
  • R.J I have the same issue... I have a site (SP2007) with approx 1000 second-level sub-sites. I would like all users to have read access to all of the lists in the sub-sites (inherited). In addition, if the user is a member of the sub-site, they also get some extra contribute rights (sub-siteXXX membership group). Now, I want to do SiteCollection list queries and limit the returned data based on where the currentUser is a member of the sub-site. Out of the box, SharePoint does a good job of limiting results based on whether the user has read access to the list. But, how can I limit it to "sub-s
    – user24179
    Mar 5, 2014 at 23:30

2 Answers 2


This kind of functionality is actually available out-of-the-box as Membership sites, where users on their MySite can see what sites they are a member of. SharePoint maintains a list of membership sites for each user - that is a list of all sites where the user is granted access through the SharePoint Member group on sites.

See My Sites overview on MSDN and this related question.

Granted, the Membership sites functionality in SP2007 and SP2010 is not very flexible. It only works with the default Member group on sites. Permissions granted through other groups are ignored.

In SP2013 all this changes as users will simply be able to follow the sites they care about.


I believe Search Results are security-trimmed, so users only see search results that they are able to access.

From http://msdn.microsoft.com/en-us/library/aa981314.aspx:

"By default, Enterprise Search results are trimmed at query time, based on the identity of the user who submitted the query. When results are returned for a user's search, the Query engine performs an access check for the user's identity against the security descriptor stored in the content index for each item in the search results. The Query engine then removes any items in the search results that the user does not have access to, so that the user never sees these results."

  • I would still want the users to have access to the sites, the search scope is used in a web part and i don't want all site showing up there.
    – Bob Klimes
    Sep 19, 2012 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.