3

I have a SharePoint site collection that has no direct user permissions set, we have a policy where users are added to a specific AD group to get access to different areas, your classic Role based security using AD.

What I am finding is that if a user is removed from an AD group they will still have access to the site and items. I am aware of the token timeout, which I have reset. I have also done an IISRESET, and restarted the server last night.

If I perform a check user permissions, SharePoint keeps telling me that the user has access via the AD group. Yet I have looked at the group on AD and the user is not a member.

The user was removed from the group a month ago as they moved departments but they can still access their old department's content, which is not allowed.

Anyone else got a trick or two I can use to ensure that SharePoint validates the AD group membership correctly.

I know there is an issue with claims-based auth, but we are using classic.

  • 1
    Did you try running User Profile Synchronization Service ? – Arsalan Adam Khatri Feb 12 '14 at 13:49
  • 1
    If you are using Claims the user will keep the permissions until his claims token expires. – Robert Lindgren Feb 13 '14 at 17:43
  • 1
    I have run UPS, done a full sync and have also reset the token lifespan to very short period of time. Neither worked to correct the issue. – MrThirsty Feb 17 '14 at 9:53
1

We have a similar problem in reverse:

some users who are added to an AD group do not receive access to the SharePoint (2010) site.

We have been given a workaround which is to delete the user from the site collection:

/_layouts/people.aspx?MembershipGroupId=0

they then have the correct access based on the securty group.

Be careful, permissions given directley to the users will be lost when they are removed from site collection.

Hope this helps

  • I checked this view already and confirmed that only the AD groups reflect here. – MrThirsty Feb 17 '14 at 9:52
1

So I have been onsite today at this client, and sat with the AD administrator to check the AD groups.

It turns out that the groups in question each have another group as a member that has all AD accounts in it. So the role-based security the client wants to setup won't work.

The solution: The client has to remove the group with all accounts from the AD groups used for role-based security.

1

I had the exact same problem. The problem did not go away until I cleared the distributed cache using the Restart-CacheCluster command. I only needed to clear it once in order for the problem to resolve itself forever (using smaller expiration times)

1

It may have something to do with hidden 'User Information List'.

according to my understanding, if users are still in that list they'll still have access to your site but I'm not 100% sure on that.

Also, to see hidden user information list append this after site URL: /_catalogs/users/simple.aspx

Some information on User Information Lists: SharePoint User Information list is not being updated

Check 'All People', I'm pretty sure that user will be there even if user was removed from AD group and all other SP group... Removing user from the 'All People' section should fix the issue. If you remove user from 'All people' section it will also remove user from 'user infromation list'.

  • This didn't help. The user is in this list but from what i have read this is used to maintain history once a user is removed from the site permissions. – MrThirsty Feb 24 '14 at 8:17
  • Check 'All People', I'm pretty sure that user will be there even if user was removed from AD group and all other SP group... Removing user from the 'All People' section should fix the issue. – Connect The Dots Feb 24 '14 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.