All Authenticated Users Please Stand Up

The availability of collaborative tools as part of MOSS is one of the reasons why SharePoint has become Microsoft's number 1 selling server product of all time. Open the doors and let everyone in to collaborate with your team!

Well, not exactly. Do you really want the entire enterprise to keep an eye on what your team is doing? Furthermore, do you really want to contaminate global search results with your team site's matches for users who have no interest in your site in the first place? The answer is... probably not, depending of course on your enterprise's explicit objectives as they apply to collaboration and sharing.

Large enterprises prefer to keep team information on the need-to-know basis, which is why it is important to prevent team site information from being shared with the entire enterprise, even if by mistake. Which is why it may be desirable to disable "Add all authenticated users" link from the site permissions screen.


To disable this link, we will need to modify the site permissions screen page, which is inconspicuously named AclInv.aspx (located in the server's /Template/Layouts directory on the 12-hive). Prior to making changes, backup the file first!

Open the file in Notepad and find the following snippet of code:

asp:LinkButton id="LinkAddAuthUsers" Text="<%$Resources:wss,permsetup_addauthtitle%>" runat="server" CausesValidation="false" OnClick="LinkAddAuthUsers_Click"

Go ahead and remove this whole line, including the brackets, and save the file. No ISS reset needed for this one. Check that the link is gone by navigating to any site's permissions settings and trying to add a user:


NOTE: You still have the ability to add NT Authority\Authenticated Users to your site, but you actually have to type the entire string into the Users/Groups box. All we have done here was to disable the convenient link. So some smart SharePoint users who read this blog will be able to figure out how to make their sites universally public, but those are usually the exception, not the norm, in any organization.

Since you are already modifying this page... if you ever wondered how to disable the default setting on "Send E-Mail" (Send welcome e-mail to the new users). The checkbox option is checked by default, and oftentimes you end up spamming the new site users whom you've just added to the site with an unintentional system-generated email. To be sure, you can always uncheck the box yourself, but heck, who can honestly say that they remember to do so 100% of the time?

Still with AclInv.aspx file open in your Notepad, find the checkbox control wssawc:InputFormCheckBox, a few lines below you will see text Checked="True" -- change it to "False", and save the file. Refresh the add user page in the browser and notice that the checkbox is no longer checked by default! It a small thing to change, but it makes SharePoint users much happier and reduces the SharePoint spam they receive.

Happy Sharepointin'!