2

I have a touch-screen machine available to the public running under a domain account. This domain account is a member of an AD group for which I have denied all access at the folder level for our other internal sites and this is working just fine. Unfortunately, this machine can still access our SharePoint (MOSS 2007) Intranet even though I have denied permission in the WSS folders on the WFE server.

How do I deny access to Group X? Anonymous Access is turned off.

4
  • Why does the machine need to be running under a domain account?
    – PHLiGHT
    Nov 2, 2010 at 21:31
  • Because one of the applications is hosted on an internal web site which we have tightened down. Nov 2, 2010 at 21:36
  • What else can it access that you haven't thought of yet? Printers? File shares? Open databases? Management interfaces for servers and clients? Nov 3, 2010 at 16:51
  • @Oskar, Group Policy was applied to answer this. Nov 3, 2010 at 17:17

3 Answers 3

1

If the MOSS site has the Public group enabled, the user will be able to get in without authenticating, and there's no way to block that (because the site wouldn't know who's connecting in the first place without authentication).

If the MOSS site does not have Public enabled, something's messed up in the security settings (like everyone being a part of the site admin group).

4
  • Chris, what exactly do you mean by "public group enabled"? Nov 3, 2010 at 3:08
  • Sorry, that should have been Public Role (or maybe it was Unauthenticated Users, but that doesn't sound right). My apologies, but I've been working with SP 2010 for months now and 2007 is becoming a distant memory.
    – Chris S
    Nov 3, 2010 at 3:13
  • It's set up as an Intranet Publishing site. I'm thinking of adding that group to a SharePoint Group and restricting the members with the Web App Policy in Central Admin. Does this make sense? Nov 3, 2010 at 3:17
  • +1 for the advice on the site admin settings :-) Nov 3, 2010 at 15:04
1

I solved this by simply adding the AD group as a user for the Web Application Policy using the steps outlined in keithbung's response here:

http://www.eggheadcafe.com/software/aspnet/30654160/limiting-access-to-sharepoint.aspx

1

Are you trying to protect your network by blacklisting this account/machine under every network resource? Everything about the way you're doing this is wrong.

You really need to look into implementing VLANs. The proper approach here isn't to worry about every application. Instead, you should segregate public machines from your private network by putting them in separate VLANs with an edge firewall between them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .