“Best” Practices for Permission Management in Windows SharePoint Services 3.0
Thinks
Permissions management tends to be one of the areas that SharePoint Users have issues with in terms of understanding and over-engineering. Challenges with these differences can be minimized by considering these principles of permission management or thinking about how you want to optimize your information security.
- Take a good look at who your intended audience is for your site(s) when designing an Access strategy
- Groups are your friends
- In general, I have found that managing access in ANY system is much more manageable, controllable, easier to troubleshoot when you use groups based on user properties. (e.g. AD groups or SharePoint Groups)
- The Key is to be consistent with picking Active Directory or SharePoint Groups for access control and permissions
- Use built in Roles
- Whenever possible, easier to use and easier to troubleshoot issues
- Inherit permissions wherever you can
- Once you break inheritance, you lose your customizations
- Limit the granularity of restrictions
- Improves performance of the system and makes troubleshooting permission issues much easier
Levels of Permissions and Inheritance
- Web Application (Web Application Security Policy)
- Site Collection (Top Site Security Permissions)
- Subsite (Subsite Security Permissions)
- List (or library)
- Item (or document or folder)
- List (or library)
- Subsite (Subsite Security Permissions)
- Site Collection (Top Site Security Permissions)
Built In Roles
Site Owners and users with the Full Control permission level have the Manage Permissions permission and can manage permissions on a particular securable object.
Default SharePoint groups and permissions
-
SharePoint group name Default permission level Site name Owners Full Control Site name Members Contribute Site name Visitors Read
Links
- Online Help for your WSS site
- “Managing permissions and security”
- “Permission levels and permissions”
- Excellent BOOK!
- Microsoft® Office SharePoint® Server 2007 Best Practices
- https://www.microsoft.com/MSPress/books/12197.aspx
Clinks
Comments
Anonymous
July 31, 2008
PingBack from http://blog.a-foton.ru/2008/07/%e2%80%9cbest%e2%80%9d-practices-for-permission-management-in-windows-sharepoint-services-30/Anonymous
July 31, 2008
I've got a powershell script that will enumerate your sites and permssions at a Site-Level. I try not to go too far beneath that. Maintenance nightmare. This needs to be run on your server (it needs stsadm and the Microsoft.Sharepoint dlls)