Microsoft KB Archive/892295

= Users who are members of the local Administrators group have access to all the content in your Windows SharePoint Services Web sites =

Article ID: 892295

Article Last Modified on 11/15/2007

-

APPLIES TO


 * Microsoft Windows SharePoint Services 2.0

-





SYMPTOMS
In Microsoft Windows SharePoint Services, you may experience the following problem.

A user who has not been permitted access to the content in your Windows SharePoint Services Web sites has full access to this content. The user can visit any Web page in all your Windows SharePoint Services Web sites. Because of the security requirements in your organization, you may not want all the members of the local Administrators group to have this access.



CAUSE
This problem occurs if the user is a member of the local Administrators group on the computer that is running Windows SharePoint Services. Users who are members of the local Administrators group have full access to all the content in your Windows SharePoint Services Web sites.



RESOLUTION
This problem was first fixed in a hotfix that is now contained in a service pack. If you installed the latest Windows SharePoint Services service pack, you do not have to install the hotfix.

Note This hotfix adds functionality that is not implemented automatically. To implement this functionality, follow the instructions in the &quot;Service Pack Installation Information&quot; section.

Service pack information
This problem is corrected in Windows SharePoint Services Service Pack 2.

To resolve this problem, obtain the latest service pack for Windows SharePoint Services. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

906795 How to obtain the latest service pack for Windows SharePoint Services

Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Prerequisites
Because of file dependencies, you must be running Windows SharePoint Services Service Pack 1 (SP1) to install this hotfix. For more information about how to obtain Windows SharePoint Services SP1, visit the following Microsoft Web site:

http://www.microsoft.com/downloads/details.aspx?FamilyID=875da47e-89d5-4621-a319-a1f5bfedf497&DisplayLang=en

Restart requirement
You do not have to restart your computer after you apply this hotfix.

Hotfix replacement information
This hotfix does not replace any other hotfixes.

Registry information
You do not have to create or modify a registry key to use this hotfix.

File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel. Date        Time   Version            Size    File name -- 01-Oct-2004 01:01  11.0.6407.0        84,728  Mdspxmlu.dll 06-Jan-2005 20:40  11.0.6417.0     1,410,248  Onetutil.dll 06-Jan-2005 20:41  11.0.6417.0     2,222,784  Owssvr.dll 11-Dec-2004 01:36  11.0.6415.0     2,263,752  Sqmsto.dll 11-Dec-2004 01:36  11.0.6415.0     2,198,216  Sqmstoup.dll 08-Dec-2004 10:51                  1,145,932  Store.sql 08-Dec-2004 10:51                  1,112,100  Storeup.sql 16-Oct-2004 16:39  11.0.6409.0       137,920  Stsadm.exe 02-Dec-2004 21:34  11.0.6414.0       248,576  Stsap.dll 26-Aug-2004 23:03  11.0.6402.0        92,912  Stslib.dll 06-Jan-2005 20:41  11.0.6417.0     1,501,920  Stsom.dll 02-Dec-2004 21:34  11.0.6414.0       203,464  Stssoap.dll 06-Jan-2005 20:41  11.0.6417.0     1,055,424  Stswel.dll

Service pack installation information
To resolve this issue, install Microsoft Windows SharePoint Services Service Pack 2. Then, follow these steps:  Click Start, click Run, type cmd, and then click OK. At the command prompt, type the following command, and then press ENTER:

stsadm -o setproperty -propertyname denymachineadminaccess -propertyvalue 1

 Type iisreset, and then press ENTER.

To restore Windows SharePoint Services to its original behavior, follow these steps:  Click Start, click Run, type cmd, and then click OK. At the command prompt, type the following command, and then press ENTER:

stsadm -o setproperty -propertyname denymachineadminaccess -propertyvalue 0

</li> Type iisreset, and then press ENTER.</li></ol>

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.

<div class="moreinformation_section">

MORE INFORMATION
After you install and enable this hotfix, you must explicitly permit access to the members of the local Administrators group for the content in your Windows SharePoint Services Web sites.

Important You should not consider this hotfix to be a comprehensive security solution. After you install this hotfix, local computer administrators still have access to the SharePoint Central Administration Web pages. Therefore, users could modify sections of a Windows SharePoint Services Web site that the users do not have explicit access to. For example, users who are members of the local Administrators group could assign themselves to the SharePoint Admins group by using the Set SharePoint administration group link link. These users would then have rights to visit all the Windows SharePoint Services Web sites.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Additional query words: WSS SPS

Keywords: kbwsssp2fix kbqfe kbhotfixserver kbfix kbbug kbwsspresp2fix KB892295

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.