I have a touch-screen machine available to the public running under a domain account. This domain account is a member of an AD group for which I have denied all access at the folder level for our other internal sites and this is working just fine. Unfortunately, this machine can still access our SharePoint (MOSS 2007) Intranet even though I have denied permission in the WSS folders on the WFE server.

How do I deny access to Group X? Anonymous Access is turned off.

  • Why does the machine need to be running under a domain account? – PHLiGHT Nov 2 '10 at 21:31
  • Because one of the applications is hosted on an internal web site which we have tightened down. – IrishChieftain Nov 2 '10 at 21:36
  • What else can it access that you haven't thought of yet? Printers? File shares? Open databases? Management interfaces for servers and clients? – Oskar Duveborn Nov 3 '10 at 16:51
  • @Oskar, Group Policy was applied to answer this. – IrishChieftain Nov 3 '10 at 17:17

If the MOSS site has the Public group enabled, the user will be able to get in without authenticating, and there's no way to block that (because the site wouldn't know who's connecting in the first place without authentication).

If the MOSS site does not have Public enabled, something's messed up in the security settings (like everyone being a part of the site admin group).

| improve this answer | |
  • Chris, what exactly do you mean by "public group enabled"? – IrishChieftain Nov 3 '10 at 3:08
  • Sorry, that should have been Public Role (or maybe it was Unauthenticated Users, but that doesn't sound right). My apologies, but I've been working with SP 2010 for months now and 2007 is becoming a distant memory. – Chris S Nov 3 '10 at 3:13
  • It's set up as an Intranet Publishing site. I'm thinking of adding that group to a SharePoint Group and restricting the members with the Web App Policy in Central Admin. Does this make sense? – IrishChieftain Nov 3 '10 at 3:17
  • +1 for the advice on the site admin settings :-) – IrishChieftain Nov 3 '10 at 15:04

I solved this by simply adding the AD group as a user for the Web Application Policy using the steps outlined in keithbung's response here:


| improve this answer | |

Are you trying to protect your network by blacklisting this account/machine under every network resource? Everything about the way you're doing this is wrong.

You really need to look into implementing VLANs. The proper approach here isn't to worry about every application. Instead, you should segregate public machines from your private network by putting them in separate VLANs with an edge firewall between them.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.