Vanishing SharePoint Groups

It’s like an episode of CSI – all of the evidence points to one suspect for half the show and then the surprise evidence shows up and turns the case on its head. You don’t usually expect that to happen in IT.

The email comes in “Help please… sudden loss of access to Project Management SP Site.” I’m able to get to the site, so it’s not down. Further details come in and the group “All Projects Staff” is missing, of course they want to know what WE (our IT group) did to cause this. So I run the audit report and have the satisfaction of reporting that the business site manager (the one reporting the issue,) “Vinny Dadeleter”, deleted three groups that day. Now the tables are turned – he’s swearing up and down he’s done nothing to the permissions – hasn’t even been in the site settings. But it’s all there in the audit logs:

Item Type User Id Document Location Occurred (GMT) Event Event Data
Site Collection DOMAIN\vinny.dadeleter sites/PRJ


Security Group Delete <groupid>1019</groupid> DMS Staff
Site Collection DOMAIN\vinny.dadeleter sites/PRJ


Security Group Delete <groupid>785</groupid> All Projects Staff
Site Collection DOMAIN\vinny.dadeleter sites/PRJ


Security Group Delete <groupid>1018</groupid> CC Staff

Case closed – right?

Well Vinny wasn’t going to take the fall and did some research. He discovered this article on the forums about “Vanishing SharePoint Permissions” and sent it to us. He had indeed deleted a sub-site almost a month before. I had the backup from last night restore the content database to my test farm. I was able to see the groups there (from which we restored them to production), then cleared the recycle bin, and the groups disappeared.

I am now in the process of trying to reproduce this in my test environment without success. I’ll post more when I discover how to reproduce this. If this has happened to you, please let me know with as much detail as possible, what were the groups, where were they created, and what site templates were used.


5 Responses to Vanishing SharePoint Groups

  1. Daniel V says:

    Did you ever figure out what caused this? We just had two groups vanish as well.

  2. Frank T. says:

    this has happened to us 2x now. We are on the June 2011 CU and will updating to the DEC 2012 CU in hopes it resolves the issue.

  3. Jothi says:

    It happened to us in Production and almost 8000 users lost access due to default groups deletion mysteriously.Tried to reproduce the issue in Test and could not.
    Please share more information

  4. Paul says:

    This has also happened to us on more than 1 occasion, any update would be grand…

  5. Hi,

    We had similar problems with Site Columns and Site Content Types created from InfoPath Designer, and the Reusable Workflow Associations to those types as well. We used database transaction logs (LDF) to trace the deletion to the recycle bin cleanup job (it had been 60 days since a subsite was deleted). Also tasked ourselves to reproduce but didn’t for some reason, so it caught our new developer unawares a couple years later.

    It’s good to know that groups are also affected. Thanks for sharing.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: