Hi all, I have a site where I listed 4 people with contribute rights. I have a test user that is NOT one of the 4 people, but he still has access to the site and all the content. SharePoint 2007 I broke inheritance from the home page He is NOT an Admin to the site or in any admin groups. He is only a domain user in AD as well. Any and all ideas are welcome. SharePoint is losing credibility with my Executives. They do not have a warm and fuzzy about securing sensitive data. TIA, Joe

Can you check to see if you have domain users or any AD groups in which the user is a member of has access to the site. One other area to look will be to see if you have any groups in User Permissions for Web applications under Application Management in Central Administration. HTH Nagesh S Days and years do not mean anything to me. Moments shared are frozen in their time frame. Distance or time never fades them for me. I cherish them like my life. I have never let them sleep alone. Sachi

This user has no rights to anything, but an "intranet visistors group". This group has Read rights to a workspace subsite of the site in question, I removed my test user from the "Intranet Visitors" and he still has access to all. I have an Admin tool from Idera that shows all access for users, and it confirms that the only permissions he had was to the subsite. I checked the user permission for web apps, but I didnt see a place for a group in there. All options are checked off.

Applogize. my mistake. what you want to look in is Policy for web application. Central Administration > Application Management > Policy for Web Application See if you have any AD groups there. HTH Nagesh S Days and years do not mean anything to me. Moments shared are frozen in their time frame. Distance or time never fades them for me. I cherish them like my life. I have never let them sleep alone. Sachi

only the system account and NT AUTHORITY\LOCAL SERVICE This is just too bizarre that the security for SharePoint is so flaky. Thanks again, Joe

Hi, Please try the following steps to troubleshoot your issue: 1. Which account are you using for web application pool account? 2. Check if the user is the server farm account in the farm. 3. Did this site allow anonymous access? 4. Check the site permission to make sure the user has no permission on the site. Let me know the result. Xue-Mei Chang