Thursday, June 30, 2011

2003-2007: User lost ability to add/remove user permissions.

Security in SharePoint 2007/2010 is very different from SharePoint 2003. That may cause a lack of permissions on target SharePoint after migration.
How 2003 security works:
You can create a new group with a custom permission set which allows users of the group to manage the site permissions:
Then you add a user to the group:




In SharePoint 2003 the USER5 user can add/remove users do the group.


How 2007/2010 security works:

The new version of SharePoint works differently.
For each group, an Owner should be specified. Also there is Group Settings where you could specify who can edit membership of the group:


So, that means even if you grant Full Control to a particular user on SP 2007/2010 that does not mean he will be able to add/remove users from site groups or change the group settings.

Who can edit permissions in SharePoint 2007-2010: 
  1. The Group Owner of a SharePoint group has permission to add / remove users from a group.
  2. The Site Collection Administrator has permission to add / remove users from a group.
  3. Only one person (or group) can be assigned as the Group Owner.
How Migration Manager handles this.

Migration Manager creates corresponding groups on target site and sets the "{Site Title} Administrator" group as owner.
So, after the migration the users who were in the "My Custom Group" with the custom permission set won't be able to add/remove permissions on target site.
As a workaround, add users to the {Site Title}Administrator group or create a separate group with all the required users included and set it as Owner for groups.
You should keep in mind that adding a user to the Administrators group may add some extra permissions for the user.