User with Full Control Permission is getting Access Denied Message

Question

The user who's responsibility it is to build up and maintain our training portal is receiving the "Access Denied" message when she tries to edit her page. Her permission level is "Full Control".

I have tried removing/re-adding her. I have tried selecting multiple permission levels - both simultaneously and individually. Both with no luck.

Have just checked, the same happens for any user with full control permissions within this site.

Does anybody know what could be causing this?

Thanks in advance.

Answer 1

Solved!

Though I'm still not certain why it occurred on this site and on no others...

I simply had to provide global read access to the master page library. Site actions > site settings > Master Page and page layouts > Library tab > Permissions. Add All authenticated users to READ ONLY.

Answer 2

The scope of your problem may range between the ones that are mentioned below. Have them carefully checked.

1. Master page or the Page Layout used by the home page are being checked out by Site Collection Admin or is lying in "pending" approval state.

2. Any custom solution that might be added in the landing page can cause access issues. Verify closely the uls logs for this.

3. Incorrect configuration of Object cache reader account renders access denied to everyone including application pool identity account let alone your site collection admins and owners. See the Full read and Full read + write are correctly implemented incase object cache reader is configured.

4. Permission level policy at the web application levels have changed or incorrectly modified. If this is the cause, verify that the issue persists in any other site collection within the same web application.

5. The permissions of the homepage or the page the user is trying to edit of the site collection or the document library where the homepage resides has the correct permissions.

6. Try to go through the ULS logs incase the issue occurs outside the scope of the above mentioned.

Answer 3

if your site is a publishing site and you want people with read permission to see draft pages, you should make sure that these pages have been published at least once before.

Answer 4

Charles, the solution you applied should already have been in place, which means someone customised the permissions on the gallery.

The Style Resource Readers group was designed for specifically that purpose. Its default members should be NT AUTHORITY\authenticated users and/or Everyone.

When in doubt, check it all out. Compare the permissions to a newly-created Site Collection and you'll see what they should be.

Answer 5

Farm -> Application Management -> Site Collection -> Configure quotas and locks.

If it's in locked state, users and administrators can have permission denied while creating new list items, pages, or folders inside Sharepoint.

Answer 6

If you have created full custom page.So you have to give Page level permission on particular custom page.

Answer 7

Check whether the content DB is set to read-only mode. if it is in read only change it to “not locked” mode.

Answer 8

If you have disabled scripting from the SharePoint admin center

1. Go to the SharePoint admin center
2. Select Settings
3. Under Custom Script choose:

Prevent users from running custom script on personal sites or Allow users to run custom script on personal sites.

Prevent users from running custom script on user created sites or Allow users to run custom script on self-service created sites.

With powershell immediately:

Set-SPOsite https://mysite/ -DenyAddAndCustomizePages 0 

Answer 9

Check Drop off library, if users break inheritance and remove users from it, this is exactly what happens, it just happened to me today

Answer 10

I encountered this issue with a client today.

Firstly I noticed that the Master Page Gallery had unique permissions and secondly what finally resolved my issue was discovering that the site was using a custom master page, this master page had not yet been fully published.

Inheriting permissions and publishing a file resolved 4 hours of trouble shooting!

Answer 11

I had experienced this same situation. One user in an AD group with Full Control would get an "Access Denied" error when adding a "Link to a Document", but could perform all other full control tasks such as adding folders, setting permissions, etc. All others in the same AD group and with the same permissions could "Link to a Document".

TLDR: Master page was checked out; checking it in, re-publishing it, and approving it fixed the problem.

Troubleshooting: Comparing this user's access to others in the same AD group that was granted full access, the permissions were the same.

Looking at the permissions from the top of the site down, everything seemed to be in order. Checking permissions for the user, everything checked out okay (note: we follow grant not deny access methods so there was nothing denying access anywhere).

Following the advice in Arko D's post, I checked the Master Page and found it was checked out. I checked it back in, re-published, and approved it. This corrected the issue.

I'm still not sure why only one user experienced this issue, while all others in the same groups and with the same permissions had no trouble at all, but it may have something to do with when the page was checked out and the timing of when this user was added to the AD group or when the AD group was granted Full Control.

Answer 12

This solved my issue:

SharePoint O365 Permissions - Deny - Add and Customise Pages issue

In my case the permisions problem was in a team site under the main site, so I had to specify that as follows:

Set-SPOSite -Identity https://<yourdomain>.sharepoint.com/sites/<your team site> -DenyAddAndCustomizePages $false