Deny user access to a "Document Library"

Question

I'm using Sahrepoint 2010. I've created many Document Libraries according to how many departments we have in the company and i want to specify access permission to users for viewing and opening documents in these libraries according to their department.

i.e : user from "Sales Department" cannot view nor open documents stored in "Financial Department" and vice versa.

Answer 1

Warning
Depending on the number of documents you expect your users to store in SharePoint it sounds as if you're heading in the direction of disaster, by storing everything in the same Site in the same Site Collection.

Answer to asked question
You want to create an AD-Group for each department.

You should then add all departments to the guest/visitors Group in the site with all your document libraries. This will give them access to browsing that site.

For each document library you'll then have to :

• Break inheritance of permissions
• Remove permissions for the guest/vistors Group
• Add the appropriate rights for each AD-Group which needs access

To do these things:

• go to the document library.
• Click Library Permissions in ribbon
• Click Stop Ihneriting Permissions
• Select the Groups which shouln't have access and click Remove User Permissions
• Click Grant Permissions enter the AD-Group(s) and give the group(s) the permissions directly

Background information
SharePoint doesn't use the concept of Deny (Except at Permission Policy at the web application level, which you don't want to/can't use).

SharePoint only uses grant permissions.

By default every securable object (Item/Document, Folder, List/Library, Site, Site Collection) inherits permissions from their parent, but this chain can be broken.

Answer 2

You should uninherit the permissions for that library.

1. Go to that library.
2. Go to the Library Tools highlighted section at the top and click the Library tab
3. Click Library Permissions.
4. Click the Uninherit button. This will uninherit the permission from the site but copy over what it has already.
5. Delete the users you don't want to see the library. Add the ones you do.
6. Repeat for the other libraries.

**Note that this won't only deny them access, it will hide the library from them altogether.

Answer 3

You could use the Sharepoint Column and View Permission Addon. It will allow you to "deny" permissions on a particular view. If you configure one view for one department and another for another department, then you can deny the view to one or the other. Then, in the view, you could set a filter to only show certain folders or documents.

However, to use this addon, you have to disable "Managed MetaData", and the users rights for creating and editing views must be denied as well, else they can create a new view and get around your special permissions.

I have used this and it works pretty well. However, you have to set the permissions for every instance of it, as it will not export the settings if you want to export the list as a template. You'll have to go to the new instance of the list and reset the settings for the addon. The authour never programmed it to export the property bag.