Will Removal of sharepoint members group leads to access issues?

Hi,
we have a sharepoint 2013 site collection with 10 sub sites. On the top level I have members group with contribute permissions.
Due to some rules of organization, we created 3 different sharepoint groups giving contribute permissions at top level and added all the people from members group to these 3 groups based on some characteristics. After that we removed members group.
Since then when any one tries to log into the site, They are getting access required error.
If I add the members group back to the site, They are able to access.
My question is when the same person is already in one of the 3 groups with same contribute permissions at the top site level, How the removal of members group is leading to access issues?
Please guide me.
Regards
Chaitanya.

Hi Chaitanya,
As Vishal said, you need to check the issue occurs with which content in the site collection when the users try to access.
The issue may be due to that the content the users try to access has stopped inheritance from its parent and the newly created groups have no permission on the content.
In most scenarios, the Site Members group will have permission on most items even when the items have unique permissions(Stop inheritance from its parent).
When the Site Members group has been removed and the new groups have no permission on those items, then the users in the new groups will get Access Denied error.
I recommend to use Site collection administrator account to check the permission on the item where users get access denied error.
And grant permission to the new groups on those items.
Best regards,
Victoria
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Similar Messages

Advance Security manager 'Group App/Db access' issue

It appears that ASM has some issues loading calc script lists - it appears to ignore the Parameter 'Access All Calculation=false' (followed by calc script list) and sets up the group with access to all calculations. Has anyone found a workaround for this? Or is there a latest/greatest version of ASM that this functionality works in?

Take a look at the thread
User access rights list
It talks about getting security info, in particular Essbase security viewer. I did a search on the web and found this link to download it
http://maxupload.com/F62683B4
Note, I have not tried the version in the link, but looked at security viewer in the past and it looked pretty good

RRM RF Group Leader not updating RF Group Members

We cannot get RRM RF Group Leader to update the RF Group Members. On our group leader controller, it sees our other controllers in the RF group. We have APs assigned to all four of our controllers and the tx power and dynamic channel assignment do not work. When we put all of the APs onto the RF group leader controller, the tx power levels and dynamic channel assignment both work as they are supposed to. All of our settings on our controllers are exactly the same. I guess my question is, is there a set of specific settings that I need to apply before RRM starts to update from the RF group leader?

We have all four of our controllers on the same RF Domain Name. We have verified the status of the Mobility Group using eping and mping. We split up our APs on two of our controllers that are in the same 6500 and it still would not update from the RRM Group Leader. We "tricked" the WLC into moving the group leader onto the other controller that was in the same 6500. The same thing happened, now the 2nd controller won't send updates to the original controller. We moved all the APs onto the group leader and everything worked fine.

I need script which will filter a set of groups by name, and then give a CSV with direct members

I need script which will filter a set of groups by name, and then give a CSV with direct members
say it like,
$groupitems = Get-ADGroup -SearchBase "DC=fincaint,DC=local" -Filter {Name -like "*AppUsers"}
ForEach ($groupitem in $groupitems)
        IF ($groupitem.objectClass -eq 'user')
   Get-ADUser $groupitem | FT Name, Email, City, Title | Export-Csv c:\member.csv
      IF ($groupitem.objectClass -eq 'group')
   Get-ADgroup $groupitem | FT GroupName, GroupDN | Export-Csv c:\member.csv

Hi Dhiravia,
It's been a while. How is it going? If the suggestion provided by ThmsRynr doesn't help, for scripting questions, in order to get better help, it's recommended that we ask for advice in the following scripting forum.
The Official Scripting Guys Forum
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/home?forum=ITCG
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Unable to change members of AD security groups who have access to shared mailboxes

I have an exchange 2013 running for over a year now and never had any problems with it. Until recently.
A request came in to make a new shared mailbox. So I did just that and gave rights to a security (not mail enabled) AD group. Just like I Always do. Everything worked fine. A few hours later I did exactly the same for another request and then the people
could not access the shared mailbox. So I added my regular user to the AD group and I also couldn't (I tested it with OWA and Outlook). I tried to remove myself of one of my own shared mailboxes and the permissions wouldn't stick. When I removed the entire
group then the permissions were gone(and I could not access the shared mailbox). When I added it back I had my permissions back but still wasn't in the group. Then I tried adding a distribution group with the same result.
It seems when I add normal users directly to the permissions everything works.
When I had to restart the server a few days later. All changes were applied but I could not change it again.
i'm a bit stumped on this one. i'm out of options.

Hi Jelle,
"I did exactly the same for another request and then the people could not access the shared mailbox.", I would like to verify if you give the same Security Group rights to multiple shared mailboxes.
If the security group members can't have access to all the shared mailboxes they have rights, you can recreate a security group and grant permissions to shared mailboxes one by one to check the result.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

How to remove prefix from AD group names in ldap auth. provider?

Hi all,
I'm using weblogic 10.3.5 and LDAP authentication provider for accessing microsoft AD.
Group names in AD are created and look like this: PREFIX_basic_user, PREFIX_advanced_user...
but enterprise roles in ADF application are created like this: basic_user, advanced_user...
Is there a way to map AD groups to enterprise roles trough LDAP Authentication provider without adding PREFIX_ on enterprise roles in ADF application?
Thanks in advance

Powershell (or vbscript if you want to be old school).
You can trigger a powershell script which will remove the offending user(s) easily enough with out resorting to a TOLDAP pass. Nearly any script type thing would work but powershell is preferred. It can be triggered separately from the TO AD stuff and will take multiple objects to run in one pass if you can construct the command line (or create a text file and feed it in).
Otherwise, TOLDAP is the way to write to AD...
Peter

Remove Corrupted Sharepoint SQL Reporting Services

Hi,
I had my sharepoint 2013 foundation with sharepoint-SQL reporting services integrated removed from my server 2012. And I removed my sharepoint folders and regedit files for sharepoint manually to ensure complete uninstallation of sharepoint from my server.
But now I did a reisntall of sharepoint and it works completely fine, but when I tried to install the reporting services again I cant as it says it is already installed but the service is not listed in my sharepoint Services list and when i tried removing
the reporting service using the SQL installer from control panel it exits with an error
Action required:
Use the following information to resolve the error, and then, try to uninstall this feature again.
Feature failure reason:
An error occurred during the setup process of the feature.
Error details:
§ Error installing SQL Server Reporting Services
There was an error attempting to remove the configuration of the product which prevents any other action from occuring. The current configuration of the product is being cancelled as a result.
Error code: 25012
Log file: C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20150220_144131\sql_rsshp_Cpu64_1.log
Visit http://go.microsoft.com/fwlink?LinkId=20476&ProdName=Microsoft+SQL+Server&EvtSrc=setup.rll&EvtID=50000&ProdVer=12.0.2000.8&EvtType=sql_rsshp.msi%40Sqlmsirc_NotifyFeatureStates_64%4025012 to get help on troubleshooting.
§ Error installing SQL Server Reporting Services
Install-SPRSServiceProxy : The term 'Install-SPRSServiceProxy' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.At
line:1 char:35+ & {$DebugPreference = 'Continue'; Install-SPRSServiceProxy -uninstall}+
~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Install-SPRSServiceProxy:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException
Error code: 0x80131500
Visit http://go.microsoft.com/fwlink?LinkId=20476&ProdName=Microsoft+SQL+Server&EvtSrc=setup.rll&EvtID=50000&ProdVer=12.0.2000.8&EvtType=0x6A1944E2%400xC68B78F0&EvtType=0x6A1944E2%400xC68B78F0 to get help on troubleshooting

Install the sharepoint reporting services add-in to the exact same drive where you installed it before using the MSSQL installation file, now uninstall the add-in and the reporting service feature from the control panel. This will remove the corrupted
files completely and now do a fresh installation

How to remove 'On My iPhone' group

When I go to Contacts > Groups I have 'All Contacts', 'On My iPhone', 'GMail.'
I am more than happy letting GMail handling my contacts over-the-air, how can I remove the 'On My iPhone' group?
Under Settings > Contacts, I only have GMail syncing so that 'On My iPhone' shouldn't be there.

This usually means you are or were syncing contacts direct with a supported address book application on your computer via the iTunes sync process, which is selected under the Info tab for your iPhone sync preferences with iTunes. Doing both duplicates the contacts on your iPhone. To get rid of the "On My iPhone" Group, make sure syncing contacts is not selected under the Info tab for your iPhone sync preferences with iTunes followed by selecting Apply.
On your iPhone, go to Settings > Mail, Contacts, Calendars.
Select your Gmail Exchange account.
Turn Contacts off for over the air syncing.
You should be provided a warning message indicating this will remove all contacts downloaded from and being kept synchronized over the air with your Gmail online address book. You should also be provided a prompt to save these contacts locally on your iPhone. Decline this prompt.
Follow this by turning contacts back on for over the air syncing with your Gmail Exchange account on your iPhone. You should be provided a merge prompt to merge the "On My iPhone" contacts stored locally on your iPhone with your Gmail online address book. Select Merge.
This should get rid of all duplicates and the "On My iPhone" group.

How to remove pound symbol # and preserve leading zeros in BEx Query

Hi,
I have two questions regarding the display in BEx Query.
1. How can I remove the pound symbol # for blanks in BEx Query?
2. How can I preserve leading zeros? At the moment, value "001" will be displayed as "1". But I need the leading zeros.
Thanks.
Joon

Hi ,
You can apply these settings in Bex query designer.
If you need to remove pound symbol jsut make a new formula and use NODIM function you will find this function under data functions.
So NODIM(Your price keyfigure) this will remove the Pound symbol.
For # just find out against which characterstic you are getting # then go to default values panel there you will find all your characterstic which you are using in report---Rt click -Restrict-single valuesdirect input-#-Move to selection(That forward arrow)--select that # and choose exclude from selection (That red square icon).
And yes for leading zeros check out this thread
Leading zeros not displaying
Hope it helps you.
Regards,
AL
Edited by: AL1112 on Jun 9, 2011 1:43 PM
Edited by: AL1112 on Jun 9, 2011 1:47 PM

HT5760 You need to make the function available to remove yourself from iMessage groups.

It's so annoying you can't remove yourself from iMessage groups, is this something you will ever allow?

WE don't have to do anything.
WE are users.
WE are NOT Apple.

Let group leader change his memeber's pwd without giving him 'alter user' p

Hi, all
Is there any way that I can let a group leader to reset his own member's password without giving him the 'alter user' privilege ?
I know I can use following simplified procedure to allow one person to change his own password, but I am looking for a way to let leader to reset when his members forget their pwd, and the following script can't work. I also created the synonym and grant 'execute on' to him. Can someone help me on this?
Thanks in advance.
CREATE OR REPLACE PROCEDURE change_pwd ( v_username in varchar2, v_pwd in varchar2)
authid current_user
is
BEGIN
execute immediate 'alter user '||m_username||' identified by '||v_pwd ;
END ;
----

SQL> @example
SQL> spool capture.log
SQL> create user alladmin identified by adminall;
User created.
SQL> grant connect to alladmin;
Grant succeeded.
SQL> grant resource to alladmin;
Grant succeeded.
SQL> grant alter user to alladmin;
Grant succeeded.
SQL> create user member1 identified by No1knows;
User created.
SQL> grant connect to member1;
Grant succeeded.
SQL> create user member2 identified by No1knows;
User created.
SQL> grant connect to member2;
Grant succeeded.
SQL> create user gl1 identified by secret;
User created.
SQL> grant connect to gl1;
Grant succeeded.
SQL> grant resource to gl1;
Grant succeeded.
SQL> connect alladmin/adminall
Connected.
SQL> CREATE OR REPLACE PROCEDURE change_pwd ( v_username in varchar2)
2 is
3 m_username varchar2(100);
4 v_pwd varchar2(30) := 'FUBAR1';
5 BEGIN
6 select user into m_username from dual;
7 if (m_username = 'GL1')
8 then
9 execute immediate 'alter user '||v_username||' identified by '||v_pwd ;
10 end if;
11 END ;
12 /
Procedure created.
SQL> grant execute on change_pwd to gl1;
Grant succeeded.
SQL> connect gl1/secret
Connected.
SQL> exec alladmin.change_pwd('MEMBER1');
PL/SQL procedure successfully completed.
SQL> exec alladmin.change_pwd('MEMBER2');
PL/SQL procedure successfully completed.
SQL> connect member1/FUBAR1
Connected.
SQL> select user from dual;
USER
MEMBER1
SQL> connect member2/FUBAR1
Connected.
SQL> select user from dual;
USER
MEMBER2
SQL> exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining optionsAny more questions?

WLC RF Group Leader election - can config. influence this?

Hi,
Can config. influence this?
Regards, MH

Hi Mark,
Hope all is well with you :) The answer to this question is not really. Have a look at why this is;
RF Group Leader
The members of an RF group elect an RF group leader to maintain a "master" power and channel scheme for the group. The RF group leader is dynamically chosen and cannot be selected by the user. In addition, the RF group leader can change at any time, depending on the RRM algorithm calculations.
The RF group leader analyzes real-time radio data collected by the system and calculates the master power and channel plan. The RRM algorithms try to optimize around a signal strength of -65 dBm between all access points and to avoid 802.11 co-channel interference and contention as well as non-802.11 interference. The RRM algorithms employ dampening calculations to minimize system-wide dynamic changes. The end result is dynamically calculated optimal power and channel planning that is responsive to an always changing RF environment.
The RRM algorithms run at a specified updated interval, which is 600 seconds by default. Between update intervals, the RF group leader sends keep-alive messages to each of the RF group members and collects real-time RF data.
The RF Group Name is an ASCII string configured per wireless LAN controller (WLC). The grouping algorithm elects the RF Group leader that, in turn, calculates the Transmit Power Control (TPC) and Dynamic Channel Assignment (DCA) for the entire RF Group. The exception is Coverage Hole algorithm (CHA), which is run per WLC. Because RF Grouping is dynamic, and the algorithm runs at 600-second intervals by default, there might be an instance where new neighbors are heard (or existing neighbors are no longer heard). This causes a change in the RF Group that could result in the election of a new Leader (for one or multiple logical RF Groups). At this instance, the Tx Power Threshold of the new group leader is used in the TPC algorithm. If the value of this threshold is inconsistent across multiple controllers that share the same RF Group Name, this can result in discrepancies in resultant Tx power levels when the TPC is run.
From this good doc;
Radio Resource Management under Unified Wireless Networks
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008072c759.shtml
Hope this helps!
Rob

Remove user from multiple groups

Hello everyone, first time posting here with a question and I apologize if I'm asking in the wrong location.
To give an idea of what I'm attempting to do, I've recently been developing a vbscript that will take a nightly csv export from my student information system and either create or deactivate student accounts based upon their enrollment status. I have
this function working great now, another function I've been developing is to have accounts moved between OU's based upon the school building code assigned to students which I have working as well. The problem I'm running into right now is having students
removed from existing active directory groups when they move between OU's. Essentially what I would like to do is have the script load the users group membership into an array and then remove any groups that end with STUDENTS, below is the code I have
been working on to accomplish this but have literally hit a brick wall. If it helps all my student groups for each location runs in this fashion.
ABCD_STUDENTS
ABCE_STUDENTS
Any suggestions would be greatly appreciated.
' Student changing OU then we need to update their account to reflect appropriate group memberships.
Set UserObj = GetObject("WinNT://server.domain.net/" & ADusrname) 'This must be hardcoded to domain controller
strUserDN = DN
strUserCN = objuser.cn
'Add user to the school group if not correct
Set objGroup = GetObject(varSchoolGroup)
strUserDN = DN ' Bind to the user object.
strGroupDN = varSchoolGroup ' Specify group Distinguished Name and check for membership.
Set objADObject = GetObject("LDAP://"& strUserDN)
objmemberOf = objadobject.GetEx("memberOf")
If Not (funIsMember (GetObject("LDAP://" & strUserDN),varSchoolGroup)) Then
objmemberOf = objadobject.GetEx("memberOf")
For Each objGroup in objmemberOf
Set objGroupDelete = GetObject ("LDAP://" & objGroup)
If Mid(objgroup,7,8) = "STUDENTS" Then
msgbox "test remove"
objGroupDelete.PutEx ADS_PROPERTY_DELETE,"member",Array(strUserDN)
objGroupDelete.setinfo
subUpdateLogFile studentcounter & " - Removed from student group " & objgroup,student_guid,student_username,student_fullname,"removed group"
End If
Next
'Add user to school group
Set objGroup = GetObject(varSchoolGroup)
objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array(struserdn)
objGroup.SetInfo
subUpdateLogFile studentcounter & " - Updated school group to " & student_schoolgroup_ldap,student_guid,student_username,student_fullname,"school group"
objUser.SetInfo
updated = "yes"
End If
Any suggestions would be greatly appreciated.

With Bill. This can be done with AD and PowerShell in a couple of lines for reach item.
You are taking an incorrect approach which is making this much harder than it needs to be. Your question is also hard to understand.
Each AD usre object obtained via ADSI will have a list of groups the account is a member of. You use this to remove the user from the group. How you choose this is up to you. You can use an array or a file. You can also =just use
OU associated groups. A user then is added to all or some groups associated with the OU and removed from the groups associated with the OU by just returning the OU associated group list from the OUs.
Designing AD systems is a specialty. Once you fully understand the features and capabilities of AD these things are usually simple and painless. If the design is not done well they are painful and faulty.
We can answer specific questions. Understaning the design and capabilities of AD is mostly up to you.
Start with a tool that is designed to work well with AD like PowerShell. VBScritp is onluy useful to those who are skilled with AD and scripting in VBSdcript. From your script we can see you are a beginner at both. As Bill notes...do yourself
a favor and switch to PowerShell.
¯\_(ツ)_/¯

Sync Project Online Security Group to SharePoint Security Groups

Hi,
Is there any way to sync prject server security group(Custom) into SharePoint Security Groups.
My scenario is: I created a document library, I want to apply project server security on it, based on project server security groups, for that currently I created a custom group in sharepoint and manualy added the users into that group. That doesn't looks
good, because if my project online group will change, than manually I have to change sharepoint group too. So what I want is, that sharepoint group is automatically synced with project online group.
Or is there any other way to assign project online security in document library?
Thanks
PSN

No there is no workaround other then creating a group on Office 365 server.
SharePoint Online lets you create security groups via the Admin Overview page
http://technet.microsoft.com/en-us/magazine/hh395478.aspx
Just found a 3rd part. check if it can help
http://en.share-gate.com/blog/migrate-to-office-365-configure-sharepoint-to-use-active-directory
Active Directory Synchronization: Allows you to sync your Active Directory Objects such as users and groups to your Office 365 account. This is a one-way synchronization, which means you continue to manage users On-Premises, and your changes
will appear on Office 365 SharePoint. However, authentication and passwords are still managed by Office 365. It will be required for Password Sync and Single Sign On (see below).
If this helped you resolve your issue, please mark it Answered

My MacBook Air 13' (2013) will occasionally start the fan at full blast, not connect to any wifi or detect any wifi, and will remove the battery icon from my menu bad as well as tell me there is no battery connected. How do I fix this?

My MacBook Air 13' (2013) will occasionally start the fan at full blast, not connect to any wifi or detect any wifi, and will remove the battery icon from my menu bad as well as tell me there is no battery connected. How do I fix this? I have restarted my computer multiple times, **** it down, and ran a diagnostic test to tell me nothing is wrong and my computer is not running any applications. There is no reason for the fan to be on full blast! when I try to set the option to show my battery icon in the menu bar, it will automatically uncheck. How do I fix all of this?

Have you tried SMC and PRAM resets?
http://support.apple.com/kb/HT3964
http://support.apple.com/kb/ht1379
Ciao.

Will Removal of sharepoint members group leads to access issues?

Similar Messages

Maybe you are looking for