Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a lot of people in our company: employees, contractors, people in joint ventures, etc. So, we want to control access to our intranet. To do that, we need to be able to prevent people in SharePoint from granting access to "Authenticated Users." Is there a way to do this?

One way it seems feasible to do this is to deny access to Authenticated Users in web application policy, but that seems like it would override everything else, basically preventing anyone from accessing SharePoint. I may be wrong.

share|improve this question

migrated from Aug 18 '09 at 14:12

This question came from our site for computer enthusiasts and power users.

This is more a "through obscurity" technique - but you can remove the "Add all authenticated users" link from the permissions page. More savvy users will still be able to type in nt authority\all authenticated users - but it keeps the average Joe from easily adding the group.

share|improve this answer
up vote 1 down vote accepted

The only way to do this properly is through the web.config. We can deny authenticated users, but allow a specific group to access SharePoint. The built-in SharePoint web application security won't do it, because denying Authenticated Users shuts everyone out. You have to use the regular ASP.NET conventions in the web.config to restrict access.

share|improve this answer

(if i understand well) delete "Authenticated Users" from your website, disable access to security info for the users and manage yourself

share|improve this answer
there is an "add all authenticated users" link when adding users/groups to a resource. removing the permissions for NT AUTHORITY\Authenticated Users will not get rid of this link... – shufler Aug 18 '09 at 14:31

You can also modify the permission that you are granting end users. Frequently admins will grant "full control" to site owners - without really taking a look at what permissions you are really granting.

In addition to giving users the ability to grant access to other users, you also grant them the ability to create sub-sites and other little tricks that make DR more difficult than it needs to be.

For me - once I add my users to the owners group - I then modify group settings, and change the permissions level of owners from Full Control to Design. That's all most users want anyway. To be able to contribute - or have some design input on their collaboration site (I.E. add a web part, create a list etc).

When they ask to add another site below the first, I create a page for them - and show them how that accomplishes the same thing.

We manage user access via AD groups - so adding users to a site is really more about having a network admin add a user to the AD group. Seems to work for us.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.