0

I have an AD group called "internal users" which has read-only access to the whole root site for my site collection. Everyone is fine with the access, as long as I don't move them out from this group to some other group, even when that group have read-only access to the root site, too.

The only workaround for this, is to give the users a role of Site Collection Administrators, which of course is not acceptable in any reasonable circumstance.

We are using AD domain groups and not SharePoint groups to manage authorization to our sharepoint solution.

The problem is that every user who is not in the "internal users" or "site collection administrators" group has no access to the root site, they get an "access denied" error.

Do you know what might be happening to my site collection/web application in this case? any ideas so as to know what should be checked?

Improve this question
5
  • What exactly is the problem and what errors are the users getting and where do they see the error?
    – Dave Wise
    May 3, 2013 at 19:28
  • The users are not having access when trying to get into mysite. If I give them access to internal resources (such as lists and folders within the root site) they can using the exact resource URL. All AD groups have access to the root site in read-only mode so there should not be problems.
    – madprofessor
    May 3, 2013 at 19:38
  • Are you using the default "Read" permission level or did you create a custom permission level?
    – Dave Wise
    May 3, 2013 at 19:46
  • It is the default "read" permission. Even my "internal users" group has it on the root site. I wonder if there was some possibility that, at farm installation time, the admin. had bound the "internal users" group to some permission on the then newly installed farm.
    – madprofessor
    May 3, 2013 at 19:49
  • It is certainly possible for an administrator to screw up security so bad that all site security has to be reset via PowerShell and rebuilt by hand. I've seen it and it is not pretty.
    – Dave Wise
    May 3, 2013 at 20:00

2 Answers 2

Reset to default
1

Dive into your Read permission level and verify that the following options are checked:

  • View Application Pages
  • View Pages
  • Use Remote Interfaces
  • Use Client Integration Features

Those not being checked would cause the exact behavior you describe

Improve this answer
0

it turned out to be a non-approved master page that the root site default page was using. That explains why site collection administrators could access the site without problem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.