1

We have a SharePoint 2007 site that is viewable by "All Authenticated Users". As part of company policy, when an employee is terminated or leaves, we modify their active directory account to remain active for 30 days, with the "deny logon" option selected in order for them to have an opportunity to download their pay stub from another separate web application. This essentially gives them access to web applications, but denies their ability to logon to the network from a computer.

The problem is, this also gives them access to our SharePoint site. We wish to keep this policy, but remove access to SharePoint.

I have looked for "exclusion" permission levels in SharePoint 2007, but they don't exist as far as I can tell. Ideally, it would be nice to place these users in a group that completely denies their access to sharepoint, even though "All Authenticated Users" allows view access.

Is there a way to deny these users to sharepoint?

Thanks

Improve this question

2 Answers 2

Reset to default
3

Not directly from within SharePoint, at least not without close collusion with your AD administrators as well as some aggressive scripting. Besides, you would only be protecting SharePoint and it sounds like this is really a much larger issue that affects the whole company.

A better approach would be to look at your firewall or routing hardware and see if they offer a solution as some of them have options for situations like this. It might be possible to create an AD group called "Recent Separations" and make sure that the HR exit process flags these employees so that they get put into that group. Your network hardware could then use that group in order to determine what resources they have access to and block requests to all but what is authorized.

That said, leaving former employees IDs unlocked but in the system for 30 days is a huge security risk. If pay stubs are the only reason they need access, then it might be better overall to disable their accounts on the day they leave and find another way to get their pay stubs to them, even if that is some cobbled together FBA system that can proxy their pay stub requests.

Improve this answer
1
  • Excellent thanks for your ideas here. Hopefully we can change policy, but barring that I'm hopeful our network guys can block access by activeD group at the firewall level.
    – Kolten
    Commented May 2, 2013 at 22:17
0

you can manually manage the list of users who are allowed to access the site. Instead of using All Authenticated Users create a new Group, insert all of the employees into it, and when they leave/are terminated you can remove them from it.

Improve this answer
3
  • 2
    A better approach would be to create AD groups for "Active Employees" and for "Recent Separations" and configure AD to populate these groups automatically based on some profile attribute. You could then just grant access to the AD Group (or put the AD group in a SharePoint Group) and then not worry about it ever again from the SharePoint side.
    – Dave Wise
    Commented May 2, 2013 at 21:56
  • @DaveWise, that's surely a much better approach. But how? I don't think it's anywhere near simple, and it will require scripting (PowerShell or otherwise) and wiring.
    – Lzh
    Commented Feb 19, 2014 at 5:24
  • I'm not an AD guy but the way it was explained to me was that it was a built-in feature in AD itself. The group just had to be configured to look for specific attributes and it would include everything with them in the group automatically.
    – Dave Wise
    Commented Feb 19, 2014 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.