My permissions have changed - again!

Question

Three colleagues and myself have Full Control of our top level site. I don't often log into our site, however, a week ago I did and noticed I no longer had rights, however, my colleagues' rights were fine. Curiousily, I logged in as our Farm Admin and re-added myself at the top level & granted myself Full Control and all was fine. UNTIL today... I'm still listed at top level with Full Control however when I view All Sites, I can only see 3 sites and again, my colleagues' access has not changed. When I 'check permissions', the results are the same for me and my colleagues.

Any suggestions in troubleshooting this would be greatly appreciated!! Thanks in advance.

Answer 1

This is almost always due to an owner somewhere trying to clean up permissions and not realizing what level they are at. There are numerous fixes for this, including locking down permissions, etc. However, to find out when it happened and who did it, run a SharePoint Audit Report (it is in Site Settings at the Site Collection level) and look for security related events. If auditing is not enabled, it really should be at least for key events such as security changes, deletions, etc..

If you and the two other people need full control over the site for site administration and support purposes, you might want to consider using a Web Application Policy instead as those always override any security within the web application itself. These are created in Central Admin - Security - specify web application user policy. The best practice for this is to create an AD group for SP Admins and grant that group Full Control permissions for the associated web applications. Naturally, since this bypasses all Site Collection security, it should not be used if the web application contains highly sensitive data that the admins should not be privy to.