[Webinar] Streamline your web hosting managementRegister Today


Why are SharePoint 2013 permission levels inherited on this subsite?

Posted on 2015-02-16
Medium Priority
Last Modified: 2015-02-19
Hi, first time poster in need of some advise :-)

I have a SharePoint 2013 Enterprise environment set up (one application server + another database server). One site collection with a few subsites.

* Top-level site
** Subsite #1
** Subsite #2
** Subsite #3
etc ...

All subsites have their own unique permissions (SharePoint groups). I am administrating the site collection as a Site Collection Administrator. I'm able to create my own custom permission levels on all subsites as needed. I need to create a new custom permission level only available on this one specific subsite*.

*This is the one subsite where I cannot create my own custom permission level. I can confirm via the site settings that neither permissions nor permission levels are set to inherit anything. As far as I can tell this subsite isn't configured any differently than the other subsites.

The view from a subsite where I can create my own custom permission levels.The view from the subsite where I cannot create my own custom permission levels
Current workarounds
1. Go to the Top-level site and create a custom permission level which will be made available on the subsite. I would like to avoid this approach as it would no doubt lead to much "clutter".
2. Delete the entire subsite and create a new one, move all content here. I would also like to avoid this approach as I need to learn why it happened so I can avoid it in the future.

Can someone please help me understand why this is and how I can solve the problem? Feel free to ask me anything as I suspect I have overlooked something somewhere.
Question by:Auhn
  • 5
  • 4
  • 2

Expert Comment

ID: 40611832
its looks like the second subsite is still inheriting permissions from the parent

can you check on the ribbon if there is stop inheriting

or try  to stop inheritance with powershell If you have access to central admin

$url = http://SharePointSite.com/SubSite
$web = Get-SPWeb -Identity $url

Author Comment

ID: 40612135
Thanks for the reply, I did as you suggested.

The subsite isn't set to inherit permissions.I checked the "Show these items." link. The blurred location is a folder in a document library. But that shouldn't have any bearing in the case.PowerShell
I logged in as the farm administrator account on the application server and ran the following command via SharePoint's powershell:
I checked the subsite again and it appears unchanged. I'm still not able to change permission levels.

Expert Comment

ID: 40612331
can you try to open the addrole.aspx page of the subsite replacing your site urls below


The previous versions of SharePoint it was not possible to change permission level from a subsite
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.


Author Comment

ID: 40612651
I accessed .../_layouts/15/addrole.aspx from two different subsites:
Subsite with problems: http://sharepoint/subsite1/_layouts/15/addrole.aspxWorking subsite: http://sharepoint/subsite2/_layouts/15/addrole.aspxHad to change diagnostic logging for Event Level from Warning to Information and Trace Level from Medium to Verbose just to get these messages from the correlation ID when I attempted to access the addrole.aspx on the subsite with problems.
Dug out the correlation ID with ULS Viewer:

Expert Comment

ID: 40614044
I checked from my side I am getting the same error on all subsites

You cannot customize permission levels in a web site with inherited permission levels. at Microsoft.SharePoint.ApplicationPages

I am sure the permission levels are inherited from the parent site even though the permissions are not inheriting from the parent.

are you sure the site you are referring to is not a subsite?  if you check In Central Administration, on the Application Management page, in the Site Collections section, click View all site collections.
The Site Collection List page lists all the site collections in the web application.

Do you see the site you are referring to as subsite there?

Author Comment

ID: 40614106
I did say I would double check everything anyone asked so here I go :-)
I logged in to Central Administration and navigated to Application Management \ Site Collections \ View all site collections:This is the complete Site Collection hierarchy illustrated. Green is Top-Level Site, blue are subsites with unique permissions and the red subsite, while having unique permissions, is the problem.This is what I'm talking about; as far as I can tell it should be working. The logs, configuration, everything is telling me that it should work. Except it doesn't, something, somewhere, somehow has caused an error to occur and I don't know what. Any new subsite I create works just fine, there's no hint of this error there. So I know it's not a general issue with our SharePoint environment. I think no one else has screwed anything up because only one person other than me has Full Control ownership of the subsite. That person swears on his family's grave he hasn't done anything.

Is there any way to check by powershell or other means how our SharePoint perceives its sites' inheritance? Kind of like the powershell script you asked me to run in order to certifiably break all inheritance for the subsite. Obviously the subsite is nonetheless inheriting from the TLS, and that has to be apparent somewhere in some configuration or information retrievable by powershell. Or even by venturing directly into the database.
LVL 21

Expert Comment

by:Walter Curtis
ID: 40614398
It seems that you are confusing permission levels with permissions. They are totally two separate things. Permissions levels should really not be messed with and only create a new one for special occasions, such as a permission named "Contribute minus Delete."

What you probably need to do, it approach your situation using the process of creating SharePoint groups, assign the appropriate "permission level" to it, then add users to that group. Then use those groups for your security structure. You could also grant a user a certain "Permission" from a "Permission Level".

Rethink your approach, it may need going back to the drawing board, maybe a review or security documentation for SharePoint.

Hope that helps

Author Comment

ID: 40614438
Thanks for your reply and suggestion. I've begun to rethink my approach since I can't seem to get to the bottom of why the problem has occurred.

Considering the issues with permission levels on this specific subsite (Subsite 7 in the hierarchy picture) I'm leaning toward saving the content, deleting the subsite and recreating it. If there is this issues with permission levels then I can't trust there are no other errors lurking around that will cause me problems down the road. It's better to be safe than sorry.

I intend to do just that at this week's end unless anyone can help me find the problem's cause or how to solve it.

Accepted Solution

tapiwab earned 2000 total points
ID: 40618745

breaking permissions levels you may use powershell

$web = Get-SPWeb "subsiteurl"

after running the command is should work


Author Comment

ID: 40618994
I did as you suggested and that seemed to have resolved the inheritance issue. You solved the problem!Thank you very much for you help! I'll be sure to read up on those resources.
LVL 21

Expert Comment

by:Walter Curtis
ID: 40619012
You are making a serious mistake. You and the guy giving wrong advice are confusing permission levels with permissions.  I don't care about the points, but I have worries about how you are going down the wrong road. Just because you can do it in PowerShell doesn't make it right.

Best of luck and I really hope you don't have a major security breach in the near future.

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Scenario: Let’s say you have a quote worksheet in Excel that you use to work up sales figures and such for your clients. You utilize SharePoint to manage and keep track of these documents. You would like values from your worksheet to populate Sh…
When using a search centre, I'm going to show you how to configure Sharepoint's search to only return results from the current site collection. Very useful when using Office 365 with multiple site collections.
The Relationships Diagram is a good way to get an overall view of what a database is keeping track of. It is also where relationships are defined. A relationship specifies how two tables connect to each other. As you build tables in Microsoft Ac…
Kernel Data Recovery is a renowned Data Recovery solution provider which offers wide range of softwares for both enterprise and home users with its cost-effective solutions. Let's have a quick overview of the journey and data recovery tools range he…
Suggested Courses

612 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question