How to deny a group of authenticated users access?

Question

Our SharePoint environment has various securable objects that grant permission (at very least read permission) to the Active Directory group "all authenticated users". In other words, up until now, we wanted everyone in the company to see this stuff. Our goal now is to explicitly deny access to a subset of authenticated users. Is there any way this is possible?

We thought about creating a sub-group (within Active Directory) called "all authenticated permissible users" and then searching SharePoint for every instance of "all authenticated users" and replacing one with the other, but this is undoubtedly problematic and "all authenticated users" will still be available for folks to use.

Any ideas are welcome! Thank you in advance!

Answer 1

We actually did almost exactly that. To go a little further, we also have an audit group that created a script to monitor all site permissions and send out an email whenever someone adds the "All authenticated users" to a site so that it can be corrected within a day. It works quite well that way.