I have an AD group called "internal users" which has read-only access to the whole root site for my site collection. Everyone is fine with the access, as long as I don't move them out from this group to some other group, even when that group have read-only access to the root site, too.
The only workaround for this, is to give the users a role of Site Collection Administrators, which of course is not acceptable in any reasonable circumstance.
We are using AD domain groups and not SharePoint groups to manage authorization to our sharepoint solution.
The problem is that every user who is not in the "internal users" or "site collection administrators" group has no access to the root site, they get an "access denied" error.
Do you know what might be happening to my site collection/web application in this case? any ideas so as to know what should be checked?