Been thinking through an interesting problem I have been presented with and I'm looking for any ideas how to approach it!

Here is the scenario

  • Single Site Collection with multiple sub sites
  • NT AUTHORITY\authenticated users assigned as read to the top level
    visitors group in SharePoint. This means everyone has read access to any item inheriting permission from the top level

The requirement is to allow a user X to access a sub-site but not the top level site.

I'm loathe to create a group that needs to be maintained that contains all users except for user X

Thoughts I have had so far:

  • Policy for Web App is a no go as it’s a single site collection
  • I'm not sure if I can craft a string using the authorization in web.config to block the user X to all sites except the one sub-site they need access to

Best solution at the moment is the following:

  • Remove user X from Domain Users Group
  • Swap NT AUTHORITY\authenticated users with Domain Users group in SharePoint top level visitors group
  • Assign unique permissions at the sub web level

Any other ideas at all would be greatly appreciated!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.