Sharepoint 2013 - Search Results Permissions

Question

We have recently stood up a Sharepoint 2013 environment. We have three web applications:

• Intranet - Sort of a landing page, holds no content currently

• Corporate - Lots of back office stuff, including very sensitive
  materials

• Sales - For our sales field, lots of documentation, policies, etc.

Our Search Service Application has 3 sources and lives on the Intranet Web Application, and has two search sources, the Corporate and Sales web applications.

When someone with a normal sales AD account searches in the Sales web application, they get 0 results. When someone with administrative rights searches, they get results.

Additionally, when someone with a normal sales AD account searches and gets no results, they get the option to "search everywhere", which then returns results to all the sensitive stuff in the Corporate web application (I assume because it is using the Intranet Search Application).

All I really want is for search results to match permissions that I've setup in each web application. For the life of me, I can't find a place to modify/enforce/check those.

Any help is greatly appreciated.

Answer 1

The way SharePoint Search works it to only show results for the "stuff" to which a user has access. So to fix your problem you need to fix the Security on the Web Applications and Site Collections that contain the content. Once you have fixed the security you need to preform a Full Crawl of the content.

You should have 3 start addresses, one for each Web App, Intranet, Corporate, Sales. If you have a User Profile Service implemented, you should have a 4th start address for that, beginning with sps3://.

Your Search Service Application (SSA) should have a default READER account configured on the Web Applications, this should NOT be an administrator account. If you user the Config Wizard to build your SSA it is likely an account with too much power.

Answer 2

Make sure that the account used for search is not a farm administrator.

Security > Farm Administrators

make sure that the account used as the default search account,

Application Management > Manage service Applications > Search service application > default content access account

has correct permissions on the web application

Application management > manage web applications > user policy

then re-crawl and try search again. make sure user account has at least read on the sharepoint content that they'll be searching through.