Where have all permissions gone?

Permissions-imageSometimes people tell me that “permissions to their site have just disappeared”. They always sound angry as if SharePoint is to blame.
But permissions do not disappear by themselves, unless there is a major issue in the SharePoint setup, and I would have heard about it had that been the case.

Whether you like it or not, in most cases it is a result of human action. However there are more human actions that can mess up site permissions than you may think.

So here’s a list:

1. Could someone else have done it?

You may not be the only one managing permissions. And if there are no other people with Full Control on your site permissions level, there may be people with Full Control in lists or libraries, as in this case:

What a library with broken permissions looks like.
In this library  permissions are different from the rest of the site and there is an additional person with Full Control in the library. (“Volledig beheer” is Dutch for “Full Control”. My site has some weird language settings)

Also check people with Manage Hierarchy, because they can do that as well.
There may even be some specific permission levels which have “manage site permissions” in their role.
Additionally, there are site collection and system admins who, in theory, have the power to make changes. They should never edit permissions unless explicitly requested by the Site Owner and only when the Site Owner can not do it, such as restoring access if a Site Owner has accidentally removed him- or herself from a site.

2. Does your site have inherited permissions?

I once experienced an issue with a few sites with inherited permissions and different Site Owners. When one person removed a number of people from her site the other sites suddenly had “Access Denied” messages all over the place.  Ofcourse, she had switched to the parent site without noticing.
Fortunately, in Office365 it is hard to miss the information about inherited permissions.

This site has inherited permissions
It is hard to miss that this website inherits permissions.


3. Have you removed people with “Limited Access” from the site?

“Limited access” is a tricky thing.
It is a result of broken permissions elsewhere in the site, but it does not tell you where it occurs (in older versions of SharePoint) and which set of permissions this person or group has exactly.

You, as a Site Owner, should know that, but when you have taken over a site, or if there are several people with Full Control, you may not always realize. The only way (in older versions of SharePoint) to find out is to go through each and every library or list (In the ribbon: Library > Library Settings > Permissions for this library)
You may even have folders and sub folders with different permissions, and you will have to go through those as well to find out what permissions which folder has. 😦

To make matters worse, “Limited Access” in a site may also mean nothing, as I have explained in my earlier post.

If you think that all that “Limited Access” looks messy, you may be tempted to remove them. But that will  remove the special permissions they have! Wendy Neal has found out the hard way.

Since writing my earlier post I found that Nathalie Jard has written a very good post about Limited Access.

4. Has someone deleted a site with permission groups that you have re-used in your site?

When you create a subsite that does not inherit permissions, by default 3 groups will be created and added to your site. You can reuse these groups in other sites.
But…if you delete the original site, those 3 groups will be deleted with the site. So people in those groups will no longer have access to the other sites!

Deleting groups when you delete the site.
If you delete a site, you will delete the groups that were created for it.

Now, before I delete a site, I check if the groups have any permissions elsewhere, as follows:

Site Actions > Site Settings > Site Permissions > Click on group > Settings > View Group Permissions.

Check if group has permissions for other content
How to check if a group has permissions for other content
This group only has permissions for this site.
Fortunately this group only has access to this site and not to others.

If they have, I strip the site of all content, remove additional permissions and add a warning to the description not to delete this site.

5. Has someone deleted a permission group that you used in your site?

Someone can also delete a permission group without deleting the complete site, and without checking if that group has access to other sites or content. Always check, as under 4.

So, these are a few reasons why your site permissions may appear to have disappeared “without reason”.
If you want to lower the risk of strange things happening to your site, please read my post on good practices when breaking permissions.

Have you ever found another reason why permissions “disappeared”?

Post title inspired by folksong “Where have all the flowers gone” by Peter, Paul & Mary.

Image courtesy of iosphere at FreeDigitalPhotos.net

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s