locked
ReadOnly SiteLock results in random access denied messages RRS feed

  • Question

  • As part of a migration I need to put a site collection in readonly mode, while migrating content. When using either a sitelock or setting the db in readonly mode I get access denied from the site collection.

    This happens not necessarily on all pages I hit. The access deniesd errors are generated on the Pages library URL parameters are like: type=list&name={GUID of te pages library}.

    Reproduction steps:

    1. I'm on the top level site welcome page and everything is ok
    2. I set the sitelock to readonly (either by stsadm or central admin)
    3. I refresh the page and everything is ok (the UI is even trimmed for edit and create actions)
    4. I go to subsite A and get the access denied
    5. I the turn the sitelock off
    6. I go to subsite A - and is granted access
    7. I turn the sitelock in readonly again (as in step 2)
    8. I can still brose the top-level site and the sub site, but when accessing another sub site I get access denied.

    If I add an IISRESET to step 2, I get an access denied on the top-level site as well.

    Furthermore the differences between which sub sites I can access and which I cannot is not obvious, e.g.

    • Site 1 is ok, but I cannot access "view all site content"
    • Site 2 is ok, and I can access all sites, even "view all site content"
    • Site 3 I cannot access

    All sites are using the same master pages and page layouts for the welcome page.

    I'm running version 12.0.0.6524 (december 2009 CU).

    Please advice :-)

    /mikkel

    Tuesday, January 4, 2011 10:05 PM

Answers

  • Hi,

    While doing research on this problem, it seems like all the pages involved in render of the page should be published, checked-in, and approved otherwise we will get access denied error. I think this is considered expected behavior.

    Additionally, if you are using a custom master page, please ensure that the element MaximumDynamicDisplayLevels which is defined in master page was set to 1. If not, when the site is switched to read-only mode, page render fails with any user having denied access since the fly out menu control cannot render the sites.


    Hope it helps.

    Thanks & Regards.


    Lily Wu
    TechNet Subscriber Support in forum
    If you have any feedback on our support, please contact tngfb@microsoft.com


    Lily Wu || Microsoft Online Community Support Engineer || SharePoint
    • Marked as answer by Lily Wu Monday, January 17, 2011 1:15 AM
    Thursday, January 6, 2011 8:41 AM

All replies

  • Hi again

    After SQL profiling and about 50 IISresets I think I've found the issue :-)

    It seems that the access denied messages come from files in Pages libraries which have not yet been published (i.e. version 0.x). This is true for all kind of files (.aspx, .pdf, .doc - yes some are using the Pages library to store documents...).

    Depending on the files, I got the access denied when opening the Welcome Page of a site or when trying to browse e.g. All Site Content.

    I created a Powershell script to find these files and I was able to reproduce getting access denied messages on these specific sites. I then added functionality to publish the files and am now able to run in readonly mode, without access denied messages here and there :-)

    I would appreciate if someone from Micrsoft could confirm this (either as by design or known bug fixed in versions later that 12.0.0.6524).

    Regards Mikkel


    The script (Does not handle all scenarios - e.g. approval, but does a nice little log file):

    $URL = "http://intranet-test"
    
    function Status($web) {
     
     $web.Lists | foreach-object {
    	if ($_.Title -eq "Pages") {
      	$listItems = $_.Items
      	foreach ($item in $listItems) {
    			if ($item.File.MajorVersion -eq 0) {
    				if ($item.File.CheckOutStatus -ne "None") { 
    					$string = $web.URL+"/"+$item.File+";"+$item.File.UIVersionLabel+";Will be checked in and published as major version"
        			out-file -filePath $filePath -append -inputObject $string
    					$item.File.CheckIn("Checked in by script")
    					$item.File.Publish("Published by script")
    					$string = $web.URL+"/"+$item.File+";"+$item.File.UIVersionLabel+";Done processing!"
        			out-file -filePath $filePath -append -inputObject $string
    				}
    				else {
    					$string = $web.URL+"/"+$item.File+";"+$item.File.UIVersionLabel+";Will be published as major version"
        			out-file -filePath $filePath -append -inputObject $string
    					$item.File.Publish("Published by script")
    					$string = $web.URL+"/"+$item.File+";"+$item.File.UIVersionLabel+";Done processing!"
        			out-file -filePath $filePath -append -inputObject $string
    				}				   
        	}
       	}
      }
     }
     $web.Dispose();
    }
    
    
    [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint") | out-null
    
    $filePath = ".\log.csv"
    
    out-file -filePath $filePath -append -inputObject "FileURL;VersionLabel;Comment"
    
    $site = new-object Microsoft.SharePoint.SPSite($URL)
    $site.allwebs | foreach-object {Status $_ }
    
    Wednesday, January 5, 2011 1:16 AM
  • Hi,

    While doing research on this problem, it seems like all the pages involved in render of the page should be published, checked-in, and approved otherwise we will get access denied error. I think this is considered expected behavior.

    Additionally, if you are using a custom master page, please ensure that the element MaximumDynamicDisplayLevels which is defined in master page was set to 1. If not, when the site is switched to read-only mode, page render fails with any user having denied access since the fly out menu control cannot render the sites.


    Hope it helps.

    Thanks & Regards.


    Lily Wu
    TechNet Subscriber Support in forum
    If you have any feedback on our support, please contact tngfb@microsoft.com


    Lily Wu || Microsoft Online Community Support Engineer || SharePoint
    • Marked as answer by Lily Wu Monday, January 17, 2011 1:15 AM
    Thursday, January 6, 2011 8:41 AM
  • Hi Lily

    Just wanted you to know that creating major versions of all documents in the pages library solved the issues regarding the UI. But I stil received access denied using the Content Deployment Framework (STSADM -o export), on 0.1 versions of pages in the pages library.

    I was able to carry out the Export command, having the site collection running in "Noaddition" mode.

     

    Regards

    Mikkel

    Monday, January 17, 2011 9:04 PM