I would like all members of the DOMAIN\Domain Users' or 'DOMAIN\Users' AD groups to have read-only access to a site collection and its subsites. I have added these groups to Site Permissions at the top-level site, and given them all of the following perms: Read, Restricted Read, View Only, Site Viewer, and Site Guest.
Yet attempting to access the site by any domain user always results in Access Denied error.
The only way to prevent this error is to add these groups to the web application's User Policy as Full Read. However, this overrides restricted access to subsites (subsites which have their own restricted list of allowed users).
I really need both scenarios supported: All domain users can read all sites, except those which are locked down (subsites which don't inherit permissions).
CHECK PERMISSIONS result:
Permission levels given to MYDOMAIN\domain users :
Read, Restricted Read, View Only, Site Viewer, Site Guest Given through the "Read-Only Users" group.