1

Our SharePoint environment has various securable objects that grant permission (at very least read permission) to the Active Directory group "all authenticated users". In other words, up until now, we wanted everyone in the company to see this stuff. Our goal now is to explicitly deny access to a subset of authenticated users. Is there any way this is possible?

We thought about creating a sub-group (within Active Directory) called "all authenticated permissible users" and then searching SharePoint for every instance of "all authenticated users" and replacing one with the other, but this is undoubtedly problematic and "all authenticated users" will still be available for folks to use.

Any ideas are welcome! Thank you in advance!

Improve this question
1
  • I do not know exactly if that is Supported in onpremise sharepoint but in sp online you can use audiences for sorting specific Users into a Group
    – Sascha
    Commented May 29, 2013 at 21:51

1 Answer 1

Reset to default
1

We actually did almost exactly that. To go a little further, we also have an audit group that created a script to monitor all site permissions and send out an email whenever someone adds the "All authenticated users" to a site so that it can be corrected within a day. It works quite well that way.

Improve this answer
2
  • Thanks Dave! It's nice to know the idea is possible. Any chance you could share that script? - removing all sensitive information first of course :-)
    – Mark
    Commented May 29, 2013 at 21:06
  • Our script wouldnt do you any good as there is a good amount of pre-processing done to the audit data before it ever gets to the script. However, I can't imagine it would take longer than a few hours to throw one together in PowerShell
    – Dave Wise
    Commented May 29, 2013 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.