Sharepoint 2010 Permission level Full Control and explicit deny

I am facing a very frustating permission level issue with Sharepoint 2010. First, everything worked as expected up to few days ago.
I have a user on my sharepoint 2010 env (publishing portal) named rjo who is site collection administrator and has also Full Control permission level.
When I execute the Check Permission command from the ribbon I get the following:
Permission levels given to xxxx\rjo
Full Control
Given through the "xxx Owners" group.
The following factors also affect the level of access for xxx\rjo (xxx\rjo)
Deny
Manage Permissions
Create and change permission levels on the Web site and assign permissions to users and groups.
Deny
Create Subsites
Create subsites such as team sites, Meeting Workspace sites, and Document Workspace sites.
etc.. Seems like all the individual permissions are set to deny.
If I remove the user rjo from the Full Control permission level, all the deny permissions disappear. I have tried creating a brand new permission level with Allow permission on al items but I still get the deny when I check the permissions. Notice that this
happens for all the users.
Does anyone experienced a similar issue? I suspect some kind of Windows update to have messed up the permissions but I cannot find a way to get proper permissions to my users.

I had a similar issue.  When checking user permissions on any member of the site collection Owners group, the results were similar to those posted above.  Also noticed that some buttons on the ribbon were missing.  Also found that no user
could add content to Library.  The Add button was missing.  Issue was only happening on one site collection in the web application, so it was not a Web App Policy issue.
Eventually discovered that the site collection was locked as read-only.
Central Administration > Application Management > Configure Quotas and Locks
change the web application and site collection as needed to view setting for the affected site collection
Found lock set to 'Read-only'  Changed to 'Not Locked'

Similar Messages

  • User profile sync Sharepoint 2010 photos thumbnail with AD and Lync 2010 - error on Full Synchronization- get events 8311, 6110, 6803 FIMSynchronization Service

    User profile sync Sharepoint 2010 photos thumbnail with AD and Lync 2010 - error on Full Synchronization- get events 8311, 6110, 6803 FIMSynchronization Service
    We're trying to set up sync between Sharepoint and AD so photos are displayed in Lync.
    The certificate referenced in 8311 is not the sharepoint root cert, its the UCC cert with our FQDN of the site. sharepoint.domain.com
    Is this causing the problem with the sync and holding up the photos?
    I have tried several proposed fixes, it hasn't helped.
    tried this as well:
    http://blogs.technet.com/b/praveenh/archive/2011/05/11/event-id-8311-certificate-validation-errors-in-mss-2010.aspx
    Josh

    Try this fix and see if its sync the photos:
    http://blogs.technet.com/b/steve_chen/archive/2010/09/20/user-profile-sync-sharepoint-2010.aspx#Profile Picture Property
    http://blogs.technet.com/b/steve_chen/archive/2010/09/20/user-profile-sync-sharepoint-2010.aspx#SyncPicAD2SPS
    Update-SPProfilePhotoStore -CreateThumbnailsForImportedPhotos 1 -MySiteHostLocation <mySiteHostURL>
    Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

  • After windows update in sharepoint 2010 farm , administraion service stopped and given error when start

    Hi
    i have a sharepoint 2010 farm
    and it has total 6 servers, and in all servers i did the latest windows update
    and after update i found the sharepoint 2010 administraion service was stopped and  when i start its  given error message
    Log Name:      System
    Source:        Service Control Manager
    Date:          7/12/2014 3:01:15 PM
    Event ID:      7000
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      SPFAPP01.xyz.gov.local
    Description:
    The SharePoint 2010 Administration service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
        <EventID Qualifiers="49152">7000</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8080000000000000</Keywords>
        <TimeCreated SystemTime="2014-07-12T12:01:15.109313700Z" />
        <EventRecordID>81462</EventRecordID>
        <Correlation />
        <Execution ProcessID="576" ThreadID="3372" />
        <Channel>System</Channel>
        <Computer>SPFAPP01.xyz.gov.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">SharePoint 2010 Administration</Data>
        <Data Name="param2">%%1053</Data>
      </EventData>
    </Event>
    adil

    Are you able to run the Config Wizard? Are there any helpful messages in the Application Event Log or in Applications and Services Logs -> Microsoft -> SharePoint Products -> Shared -> Operational?
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Sharepoint 2010 user profile full synchronization process

    what is the impact of sharepoint 2010 user profile full synchronization process in sharepoint 2010 farm.
    If you have 5k users in your environment and you want to run full synchronization process, will that bring any services down?
    I guess it should only impact anything related to user profile service?
    Is my assumption correct? 
    features like people search, my profile might be impacted but not the sharepoint site itself ...
    Any input will be appreciated... 
    -Mit
    SP-Admin_Mit

    Running a full synchronisation isn't going to bring down any of your SharePoint services. How much time it takes, and the impact it will have on other SharePoint services all depends on your SharePoint architecture. E.g is the synchronisation server also
    a WFE (web front end) server? 
    According to the TechNet documentation, the synchronisation process makes heavy use of network resources, so that might be a concern. 
    Also, other factors, such as different synchronisation sources (other LOB systems you might be synchronising with) will have an impact on the time and resources used to perform the synchronisation.
    If your SQL servers and SharePoint application servers are sized correctly, you should be fine (from a SharePoint perspective).
    For more info, see:
    Profile synchronization overview (SharePoint Server 2010)
    Plan for profile synchronization (SharePoint Server 2010)
    Regards, Matthew
    MCPD | MCITP
    My Blog
    View
    Matthew Yarlett's profile
    See my webpart on the TechNet Gallery that allows administrative users to upload, crop and format user profile photos. Check it out here:
    Upload and Crop User Profile Photos

  • Sharepoint 2010 permission The following factors also affect the level of access for

    hello,
    In my development server ,suddently from no where all users ,even full control group users
    cannot able to add or edit any list or any content.
    The following factors also affect the level of access for user1(domain\user1)
    Deny
    Manage Permissions
    Create and change permission levels on the Web site and assign permissions to users and groups.
    Deny
    Create Subsites
    Create subsites such as team sites, Meeting Workspace sites, and Document Workspace sites.
    Deny
    Manage Web Site
    Grants the ability to perform all administration tasks for the Web site as well as manage content.
    Deny
    Add and Customize Pages
    Add, change, or delete HTML pages or Web Part Pages, and edit the Web site using a Microsoft SharePoint Foundation-compatible editor.
    Deny
    Manage Lists
    Create and delete lists, add or remove columns in a list, and add or remove public views of a list.
    Deny
    Apply Themes and Borders
    Apply a theme or borders to the entire Web site.
    Deny
    Apply Style Sheets
    Apply a style sheet (.CSS file) to the Web site.
    Deny
    Override Check Out
    Discard or check in a document which is checked out to another user.
    Deny
    Manage Personal Views
    Create, change, and delete personal views of lists.
    Deny
    Add/Remove Personal Web Parts
    Add or remove personal Web Parts on a Web Part Page.
    Deny
    Update Personal Web Parts
    Update Web Parts to display personalized information.
    Deny
    Add Items
    Add items to lists and add documents to document libraries.
    Deny
    Edit Items
    Edit items in lists, edit documents in document libraries, and customize Web Part Pages in document libraries.
    Deny
    Delete Items
    Delete items from a list and documents from a document library.
    Deny
    Create Groups
    Create a group of users that can be used anywhere within the site collection.
    Deny
    Use Self-Service Site Creation
    Create a Web site using Self-Service Site Creation.
    Deny
    Approve Items
    Approve a minor version of a list item or document.
    Deny
    Delete Versions
    Delete past versions of a list item or document.
    Deny
    Create Alerts
    Create alerts.
    Deny
    Manage Alerts
    Manage alerts for all users of the Web site.
    Deny
    Edit Personal User Information
    Allows a user to change his or her own user information, such as adding a picture.
    For all the users this happened ,How i need to fix this issue
    please help.
    thanks

    Take a look at the user policy settings for the web application.  I suspect someone has added a User Policy that covers the user which denies all these permissions.  The User Policy at the web app level is the only place where you can deny permissions.
     But that setting applies to every site collection in the web application and takes precedence over every other setting.
    Paul Stork SharePoint Server MVP
    Principal Architect: Blue Chip Consulting Group
    Blog: http://dontpapanic.com/blog
    Twitter: Follow @pstork
    Please remember to mark your question as "answered" if this solves your problem.

  • TS1485 change the permission level for iTunes and iTunesHelper to allow full access. how do i do this

    How do i change the permission level for Itunes

    I have actually been using Amazon cloud for a while now and never had this problem. Actually, I think I did get locked out once and was able to get back in by contacting support and answering some questions. This option isn't available with Apple.. They lock you out for 90 days regardless of whether you can verify your ID. I know this because I contacted them recently and they verified my identity exhaustively and then said 'sorry-there's nothing we can do and you are not  getting a refund for time lost.'  I think I understand why the policy is there, but I think it's ridiculous that they make no exceptions even when the mistake is on their side, which I'm pretty sure it is in my case.

  • SharePoint 2010 Item level permissions nightmare...how do I escape this madness?

    We have a custom SharePoint 2010 application that helps process job req. documents from 200+ partner companies. Each company can only see its own job req. documents (done using item level permissions in one document library).
    The number of documents is getting close to 3k. I've read that once you get over 5k, you'll see a huge performance hit because of the number of unique security scopes.
    Creating 200+ libraries is out of the question. That just seems like an even bigger logistical nightmare...especially since we add partners every month almost. We have reports that run off of this data and querying that many libraries would be nuts.
    Next would be making folders for each company. A lot of recoding would need to be done, but my biggest concern will be not being able to sort and filter properly.
    I've tried writing a PowerShell script to copy everything into folders in a new library and the filtering doesn't work even after messing around with the view to not show the folders at all.
    The last thing I'm considering is just archiving older data that may no longer be relevant by year or something.
    Has anyone else run into a similar issue?
    Any suggestions?

    Hi,
    Once you have exceeded the threshold limit, certainly there will be performance issues. However, you can still iterate though lists/libraries that exceed threshold limit by workaround here:
    List Threshold
    Additionally, please refer following link which demonstrates how you can implement sorting/paging for lists exceeding threshold limit:
    https://social.msdn.microsoft.com/Forums/en-US/4f788144-773c-4e63-8c1f-1e51f1c0a82f/client-object-model-fsobjtype-and-list-view-threshold?forum=sharepointdevelopmentprevious
    Hope it helps!
    Thanks,
    Avni Bhatt
    If this helped you resolve your issue, please mark it Answered

  • Sharepoint 2007 into Sharepoint 2010 migration MOUNT-SPCONTENTDATABASE fails and Sharepoint management shell closes automatically

    Hi all,
    I am trying to Migrate from sp2007 into sp2010. I have a heavily customized site with lots of sites, lists etc totalling upto 180GB size. Now when i perform Mount-spcontentdatabase, the command prompt ie Sharepoint Management shell closes after a certain
    period of time eg 18%. Now, if i try to re-run the command again, the database is locked, as it might still be running something in the background.
    Also, i tried running the Upgrade-Spcontentdatabase with forcedeletelock as true, so it unlocks and then upgrade, still with no luck
    So quick question Can i run the Upgrade-spcontent command before running Mount, as i noticed my database version is old and need to be upgraded. Or Mount should def be run before upgrade regardless if the database is old or not?
    Would really appreciate if someone could answer this soon?
    Thanks in advance
    cheers
    Ren

    what is the version of the SP2007, if database required upgrade then you should do this in 2007, once status says "no action required" then migrate to 2010 & mount it there.
    Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

  • Unable to delete a SharePoint 2010 My Sites content Database and IIS Web Site even after changing timeout

    Hi,
    I am currently having issues with deleting a content database for mysites which has web application http://<servername>:11100. The database was migrated from sharepoint 2010, but on creating web app it timed out (was corrupt due to this).  Problem
    is I cannot delete now as I get "Request Timed Out". Even when I try just deleting the Web App or the Content Database individually. I have already updated the timeout on the Central Admin App Pool to 300. This used to work, but no joy now. Seems
    like ever since I added this My Sites Web App I am getting this problem.
    The setup is 1 Database Server (64GB), 1 Admin Server (24GB) and 3 WFE Servers (12GB each) - all VMS. System is also running PowerPivot. Central Admin is running on a WFE server. Is this setup OK for just one user? Reason I have 3 WFE is this already existed
    and App Servers will be scaled out when we start testing. Running 11 Web Applications.
    Help appreciated - any ideas?
    Thanks.
    John.
    OH - I tried to delete with powershell and it tells me it requires SHarePoint Administration Service to be running, but the problem is it is already running on the WFE with Central Admin on.

    Hi John,
    The timeout may cause this issue. But would you let me know the error message when we delete the database?
    However, you can delete the web application(my site host) and click delete database and IIS web site option.
    Also, you can try to clean cache and check if issue persists:
    Please stop SharePoint Timer Service.
    Please navigate to the cache.ini file location:                  
    Delete all the .xml file and only leave cache.ini in the file location.                  
    Edit the Cache.ini file and set it to 1.                 
     Save the Cache.ini file
      Start SharePoint Timer Service. The cache file will be created autumnally.
    Any questions, please let me know.
    Best Regards,
    Dats Luo

  • Ms Office Document On SharePoint 2010 library does not Open and stays on downloading

    Ms office documents on a sharePoint 2010 library does not open in client and stays on
    downloading... and never opens. This hapeens to Documents more than 2 or 3 Mb. That would be great if u cuold help me, Thanks
     

    Hi,
    This is a quick note to let you know that I am trying to involve someone familiar with this topic to further look at this issue.
    Max Meng
    TechNet Community Support

  • Problems with Sharepoint 2010 view if group by and collapsed is activated - all items show up within each group!

    Hi there,
    we have a Sharepoint 2010 Enterprise environment where we use some lists for new feature ideas.
    These lists should be grouped by a certain coloums. If we keep the default view with expanded groups, only the items which should be inside a certain group will be displayed (the count is for example 7 and inside the group there are only 7 items).
    As there are a lot of groups inside the list we would like to create a new standard view with all groups collapsed. But as soon as we change the view, all groups contain ALL items from the list (what makes it really strange is that the count is still 7 but
    a couple of hundred items are inside the group even the ones which should have been filtered by the "group by" settings.
    I enclosed two pictures where you can see the difference between "collapsed" and "expanded" view (Group by settings!)
    Is this a bug or is there something wrong with our views/installation?
    Thanks for any help (by the way: i just installed the CU from April 2012 which didn't make any difference!)
    Greetings
    Jens
    "Collapsed View":
    "Expanded View":

    Hi ,
    I  understand that when you create a new standard view with group by BDE ,and all items show up when collapse is activated .I cannot reproduce your issue .This is not a bug .You should try to edit the view in browser multiple times to have a test whether
    it is showing correctly now .If this view is still not working ,you can try the workaround below :
    Open the Site in SharePoint Designer .
    Open the list and create a new view .Make the view as the default view .
    Edit the view in Advanced Mode . Click in the xsltlistview web part and Click Sort&Group in the ribbon .
    You can add Group by here .After making all the changes ,save and preview the view in browser .
    Thanks
    Entan Ming
    TechNet Community Support

  • SharePoint 2010 Edit in Microsoft Word and Save back to SharePoint not working

    Hi, I'm using SharePoint 2010 for document collaboration. I have bunch of MS Word and Excel 2010 documents loaded on the site's document library. I'm having trouble saving the documents back to SharePoint. I click on the documents "Edit in Microsoft
    Excel" or "Edit in Microsoft Word" the document opens, I work on it, then I click "Save" but it wants to save to local documents folder, not SharePoint.

    Hi,
    According to your description, documents cannot be saved back to SharePoint Library when editing in Microsoft Office desktop application.
    I tried to reproduce this issue in my environment, it turned out that all work as expected.
    You can try the steps as below to see if the issue still exists:
    1. Enable the local webclient service on the machine.
    2. Make sure that “Enable Protected View for files located in potentially unsafe location“ is unselected in Trust Center settings in Microsoft Word and Excel 2010.
    Here is a link with more details about enabling the local webclient service on the machine:
    http://support.microsoft.com/kb/2801565
    Here is a link with more details about how to uncheck “Enable Protected View for files located in potentially unsafe locations”：
    http://blogs.interfacett.com/word-2010-not-saving-back-to-sharepoint-2010-by-default
    Feel free to reply if there any progress.                                   
    Best regards
    Patrick Liang
    TechNet Community Support

  • Sharepoint 2010 Announcement With Carousel Control

    Hi Friends.,
    How to create sharepoint Announcement with carousel control.
    Thanks in advance.
    MK

    Happen to see this post and curious the carousel here is something like a
    carousel control which can make things spin like a carousel? And even can make out a
    carousel path to make the things operating on the needed route?

  • SharePoint 2010 View Group By Category and Sub-Category

    I have a document Library with Category and Sub-Category columns. In the view I am grouping by Category and then Sub-Category. However, most of the documents do not have a Sub-Category. My desired result would be that the document would appear underneath
    the Category. However, if no Sub-Category is assigned then SP creates a generic Sub-Category and puts the document there. It should look something like this:
    Category : Main Category
    Document-1
    Document-2
    Sub-Category : Sub Category
        -Document-3
        -Document-4
    Instead it is Creating a generic SubCategory:
    Category : Main Category
    Sub-Category : (1)
        -Document-1
        -Document-2
    Sub-Category : Sub Category
        -Document-3
        -Document-4

    Hi，
    Per my knowledge, when you set group by Category and then Sub-Category, it should looks like the following:
    Category : Main Category
    Sub-Category : (2)
        -Document-1
        -Document-2
    Sub-Category : Sub Category
        -Document-3
        -Document-4
    I think there is no OOTB method that could make it looks like the following:
    Category : Main Category
    Document-1
    Document-2
    Sub-Category : Sub Category
        -Document-3
        -Document-4
    Best Regards，
    Lisa Chen
    TechNet Community Support
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
    [email protected]

  • Share Button not show Permission Level

    Hi,
    We are facing a weird problem in our farm, we have until CU July 2014 versión with an authentication with ADFS2.0.
    In all Site Collections we have breaked the inherited permissions and we gave permissions directly to the SC or by AD Groups, until here, there is no problem
    But recently, we have discovered that the share button in Site collection does not work properly, in some SC it only shows the following:
    But in other sites we have done the same, and it shows correctly the Level permissions of the SC. I have checked that is not a problem with the Custom Master we have deployed, since I have created this SC with the original Seattle Master Page.
    Anyone knows what is happening??
    Thanks

    Hi again,
    With the share button, we have detected the following:
    In SharePoint 2013 Foundation, the share button points to
    http://urlsc/_layouts/15/aclinv.aspx?forsharing=1&lsDlg=1 and it shows both, SharePoint groups and permission levels (Full Control, read, design...) but in SharePoint 2013 Standard and Enterprise, this same share button points to
    http://urlsc/_layouts/15/aclinv.aspx?forsharing=0&lsDlg=1 where only displays SharePoint Groups.
    Anyone knows why this difference? It is a bug? What is the behaviour?
    Thanks

Maybe you are looking for