Deleting SharePoint Group Permissions
The Delete SharePoint Group Permissions lets you delete the permissions of one or more SharePoint groups from a single site collection or site without removing its members or deleting the group itself.
NOTE: This action deletes all permissions currently assigned to a group. Once permissions have been removed from a SharePoint group, the group will display in the SharePoint Group Analysis. Whether or not the group continues to display in the SharePoint Hierarchy or any ControlPoint group pickers depends on the Value of the ControlPoint Configuration Setting Show SharePoint Groups with No Permissions in Hierarchy.
This feature is not available at the farm (tenant) scope.
To delete SharePoint Group Permissions:
1Select the site collection or site whose group permissions you want to delete.
2Choose Users and Security > Delete SharePoint Group Permissions.
3Select the group(s) whose permissions you want to delete as follows:
a)From the Available Items list, select the group(s) to which you want to add users and move them to the Selected Items list.
Note that all groups defined for the entire site collection that have at least one associated permissions level display beneath the root site. Groups with unique permissions also display beneath the site granting those permissions. Any group that does not have at least one associated permissions level for the site collection or site will not display in the list.
TIP: If your Available Items list is particularly long, you may find it useful to narrow the scope by searching based on Group name, site Name, and/or site URL) and searching for the group. For example, if you want to narrow your scope to all group owners, enter "owner" in the Group field.
b)Click [Apply].
4If your selection includes one or more sites and you want the permissions to be deleted from all lists within the site(s) that have unique permissions, check the Propagate to All Lists with Unique Permissions box.
5If you have checked the Propagate to All Lists with Unique Permissions box and want the permissions to be deleted from all items within the list(s) that have unique permissions, check the Propagate to List Items box.
NOTE: The "Propagate" options do not apply to lists that you selected explicitly. If you want to include items within explicitly-selected lists, use the Include Children or Choose option in the Selection panel. See also Selecting List Items on Which to Perform a ControlPoint Operation.
Now you can:
·run the operation immediately (by clicking the [Run Now] button)
OR
·complete the Enforce Policy section and schedule the operation to run at a later time.
OR
·save the operation as XML Instructions that can be run at a later time.
If you chose the Run Now, option, after the operation has been processed:
·a confirmation message displays at the top of the page, and
·a ControlPoint Task Audit is generated for the operation and displays in the Results section.
If you schedule the operation, a link to the Task Audit is included in the scheduled action notification email.
See also The ControlPoint Task Audit.
Deleting SharePoint Groups
Use the Delete SharePoint Groups action to delete SharePoint groups from one or more site collections/sites in the farm.
To delete one or more SharePoint groups:
1Select the object(s) from which you want to delete SharePoint groups.
2Choose Users and Security > Delete SharePoint Groups.
3Select the SharePoint group(s) you want to delete as follows:
a)Select the group(s) from the Available Items list and move them to the Selected Items list.
Note that all groups defined for the entire site collection display beneath the root site. Groups with unique permissions also display beneath the site granting those permissions.
TIP: If your Available Items list is particularly long, you may find it useful to narrow the scope by searching based on Group name, site Name, and/or site URL) and searching for the group.
CAUTION: Because SharePoint groups are defined at the site collection level and may be used anywhere in the site collection, if you are performing the action on one or more individual sites that includes groups that are used elsewhere in the site collection, the groups will be deleted from unselected sites within the collection as well.
b)When you have finished adding groups to the Selected Items list, click [Apply].
Now you can:
·run the operation immediately (by clicking the [Run Now] button)
OR
·complete the Enforce Policy section and schedule the operation to run at a later time.
OR
·save the operation as XML Instructions that can be run at a later time.
If you chose the Run Now, option, after the operation has been processed:
·a confirmation message displays at the top of the page, and
·a ControlPoint Task Audit is generated for the operation and displays in the Results section.
If you schedule the operation, a link to the Task Audit is included in the scheduled action notification email.
See also The ControlPoint Task Audit.
Managing Permissions Inheritance
The ControlPoint Manage Permissions Inheritance action lets you break or restore permissions inheritance of sites, subsites, lists, folders, and items across your SharePoint farm.
In a multi-farm environment, permissions inheritance can be managed across multiple farms.
SharePoint Objects Included in the Operation by Default
The following table identifies the SharePoint objects that are included in the Break/Restore Inheritance operation by default.
|
Operation |
Scope |
Objects Included by Default |
|---|---|---|
|
Restore Inheritance
|
·Farm ·Web Application, or ·Site Collection |
All sites, subsites, lists, folders and items within the selected scope. NOTE: You can use the Change Selection option if you want to exclude individual sites, lists, folders, and items. |
|
Site |
The site itself and all lists, folders and items within the site. NOTE: If you have checked the Include Children box in the Selection pane (that is, you want to include child sites of the selected site), you can also choose to exclude the selected site itself (so that child sites will inherit from it). | |
|
List |
The list itself. NOTE: By default folders and items are not acted upon. You can, however, use the Change Selection option to explicitly select any folders, and items you want to include. | |
|
Break Inheritance
|
·Farm ·Web Application, or ·Site Collection |
All sites and subsites within the selected scope. NOTE: By default, lists, folders, and items are not acted upon. You can, however, use the Change Selection option to explicitly select any lists, folders, and items you want to include. |
|
Site |
The site itself and all subsites. NOTES: · By default, lists, folders, and items are not acted upon. You can, however, use the Change Selection option to explicitly select any lists, folders, and items you want to include. · If you have checked the Include Children box in the Selection pane (that is, you want to include child sites of the selected site), you can also choose to exclude the selected site itself (so that child sites will no longer inherit from it). | |
|
List |
The list itself. NOTE: By default, folders and items are not acted upon. You can, however, use theChange Selection optionto explicitly select any folders, and items you want to include. |
To manage permissions inheritance:
1Select the object(s) for which you want to break or restore inheritance.
2Choose Users and Security > Manage Permissions Inheritance.
3Use the information in the following table to determine the appropriate action to take.
|
If you want to ... |
Then ... |
|---|---|
|
restore permissions inheritance |
select the Restore Inheritance radio button. |
|
break permissions inheritance |
a.Select the Break Inheritance radio button. b.Select whether you want to: ·Copy Permissions from Parent OR ·Leave Permissions Empty. |
4If you initiated the action at the site level and want to act only on child site(s), check the Include Children only (exclude selected sites) box.
NOTE: This option is valid only if one or more sites (other than root sites) were explicitly selected.
Now you can:
·run the operation immediately (by clicking the [Run Now] button)
OR
·complete the Enforce Policy section and schedule the operation to run at a later time.
OR
·save the operation as XML Instructions that can be run at a later time.
If you chose the Run Now, option, after the operation has been processed:
·a confirmation message displays at the top of the page, and
·a ControlPoint Task Audit is generated for the operation and displays in the Results section.
If you schedule the operation, a link to the Task Audit is included in the scheduled action notification email.
See also The ControlPoint Task Audit.
Managing SharePoint Groups
ControlPoint Manage SharePoint Groups is a farm-level action that lets you propagate the permissions and membership of a SharePoint group on one site with groups on one or more different sites in the same farm. You can either:
·overwrite the membership and permissions of an existing group (but retain the group's name)
EXCEPTION: Permissions of a group within a list, folder, or item that has unique (non-inherited) permissions will not be changed.
OR
·create a new group with the same name, membership, and permissions as the model group.
ControlPoint Group Management Terminology
Association - The relationship between the SharePoint group whose permissions and membership you want to propagate and all of the groups to which you want to propagate them.
Model Group -The SharePoint group whose permissions and membership you want to propagate.
Dependent Group(s) - The SharePoint group(s) to which you are propagating the membership and permissions of the model group. You "adopt" a new dependent group when you add it to an association.
Synchronize - The act of propagating permissions and membership of a model group to its dependent groups. Whenever you synchronize groups within an association, the existing permissions and/or membership of dependent groups are overwritten with those of the model group.
NOTE: Synchronization is a one-way process (that is, model to dependents only). Although changes to model groups are not automatically propagated to dependent groups, you can schedule a synchronization to run on a regular basis to ensure that model and dependent groups remain in sync. You can choose to synchronize the permissions of the model group only, the group's membership only, or both permissions and membership.
In a multi-farm environment, SharePoint groups can be managed for a single farm; either the home farm or a remote farm.
To access the Manage SharePoint Groups workspace:
From the farm or Web Application level of the SharePoint Hierarchy, choose Automation > Manage SharePoint Groups.
The top grid lists all existing associations with the following information:
·the Association Name
·a link that enables you to Edit the Association Name.
·the model Group Name
·the Group Description (as specified in SharePoint Group Settings page)
·the Site Name and Site URL where the model group resides
·Permissions associated with the group
·the # of Users with Permissions for the group
·a Details link that lets you open the SharePoint People and Groups page for the model group.
When you select a group in the top grid, the bottom grid lists all of the dependent groups in the association, along with the following information:
·the dependent Group Name
·the Site Name and Site URL where the dependent group resides
·the Adoption Date (that is, the date the dependent group was added to the association)
·a View Details link that lets you open the SharePoint People and Groups page for the dependent group.
Now you can:
·Associate a SharePoint Group from One Site with Other Sites
·Maintain SharePoint Group Associations
·Dissolve Group Associations and/or Delete SharePoint Groups.