This has been around for a while but since I still get questions about it from clients I figured I would post an explanation that may be a little more visual that other explanations.
When you start customizing security on your SharePoint sites by breaking inheritance at different levels you may start to see your nice clean permission lists be infiltrated by “Limited Access”. MSDN explains the “Limited Access” permission level as:
Allows access to shared resources in the Web site so users can access an item within the site. Designed to be combined with fine-grained permissions to give users access to a specific list, document library, item, or document, without giving users access to the entire site. Cannot be customized or deleted.
Let’s look at a scenario:
Because we’ve broken inheritance at the document library and given John access to the document library but NO access to the parent site SharePoint automatically gives John “Limited Access” to the parent site to ensure that John has the rights to traverse the site in order to reach the document library. No actual permission to any resources at the site level have been granted.
One tool that looks promising but I haven’t used personally can be found on codeplex here: http://www.codeplex.com/SPLimitedAccessDisco
Cory Peters is the Chief SharePoint Architect at Eastridge Technology, a Microsoft Gold Partner in Winston-Salem, NC.
Nice clear writeup.
But what happens with sites and subsites?? Surely the same should apply; if a subsite has uninherited (unique) permissions then there needs to be Limited Access at the root site to allow users to surf in to the root site and navigate to the sub-site.
Unfortunately it doesn’t appear to be that simple.
Really clear (finally a diagram!!). One question … by “traverse” do you mean John Doe can get to the site by following a link to the Document Library or can he also navigate to the Document Library via normal UI browsing, just not seeing anything at the Site level other than the single Document Library he can navigate into?
This is the last bit of Limited Access I’m still unclear on. Thanks!
Thanks for this simply but very clear explanation. How do I remove the Limited Access from the parent site, subsite, fand older after I’m through with and have deleted the document. Will it automatically disappear or it’s just going to be there?
would be nice to be able to filter out “limited access”. some users have completely destroyed permission levels on library items in a site because they didnt realize how this worked. this is problematic on a library where the permissions on each item were set individually. personally, i dont like how microsoft did this, and they need to make the permissions more granular. Maybe SP2013 will fix all of these little quirks.
thanks for the clear explination.