Skip Ribbon Commands
Skip to main content

Quick Launch

FEDSPUG Portal is powered by Corasworks > FEDSPUG Blog
February 16
SharePoint Security the Easy Way

I sat down yesterday and read a great article titled “Managing SharePoint Security, Permissions the Hard Way” by Steven Pogrebivsky. It definitely does a great job at explaining the difficulties in managing SharePoint permissions with the out-of-the-box tools in SharePoint. I wanted to take the time to share my experience in managing SharePoint permissions the easier way.

Before I point out the easy way let’s recap the hard way. A new employee enters an organization and over time they accumulate permissions to various SharePoint sites. Over a period of months or years the permissions structure is as fractured as spaghetti code. Eventually the employee leaves the organization. Do you go back to every SharePoint site this employee had access to and remove them from every SharePoint group? Usually the answer is “No”. Why? Because the employee's permissions were never documented well enough for the site administrators to know wihch sites to remove the departing employee from.

Let’s take a step back and think about what existing processes we can leverage to ensure that SharePoint permissions are ALWAYS added and removed as employees enter and leave an organization. When a new employee enters an organization they are given an account in Active Directory (AD). The employee's account is also added to a few AD groups so they can access file shares and other resources on the network. When the employee leaves the organization their account is deleted from AD and any AD groups that they belonged to.

The easy solution: leverage AD groups and SharePoint groups together to manage access to your SharePoint sites. I highly recommend creating AD groups that mirror your SharePoint groups. That will allow you to add the AD groups to the appropriate SharePoint groups. All of the permissions management for SharePoint will be done in AD.

Let's look at this scenario again using the easier solution. A new employee enters your organization. This user is given an account in AD and his account is added to several AD groups - some of which will allow him access to a standard set of SharePoint sites. Over time this employee will gain access to new SharePoint sites by being added to new AD groups. When the employee leaves the organization their account is removed from AD and the AD groups. This employee has automatically lost access to all SharePoint sites within the organization. There is no need to search through the SharePoint sites to ensure the employee's access has been completely removed.

That is SharePoint security the easy way.

January 22
Mister PM, tear down dem damn silos!

​One of the things that tends to really piss me off is watching PM's do things that I know are wrong but they won't listen because they are PMP certified and therefore know everything.  More often than not that results in a bad project, I know, I have been the victim too many times.  Most PMs like to have all theoir resources permanently assigned to their team and in a big organization where you can have becoup bodies, that just might work.  Most places I have been are smaller shops so there aren't as many people.  I am a big fan of just in time resourcing using a matrix organization.  Why?  Lowers cost and improves the team.  How so you ask?  Let's look at a coupl eof examples.  Lets say Tony does UI stuff, that is all Tony does and his is damn good at it.  Now in a matrix structure I can use Tony across several projects as they need the expertise of the UI specialist and Tony gets exposed to several different business problems and solution sets in a rather rapid fashion, and his expertise grows as a result.  Or, as what happened, the PM assigned Tony to a project where he did do the UI stuff and when that was done he became for all intents, the admin guy.  Tony's UI skills were not being used where they were needed, the other PMs had to hire their own UI guys and poor Tony got bored soing something he hated doing and ended up telling the PM to pund sand and left that company. 

 

Most places proclaim, and rather loudly, that they are building Centers of Excellence, while in reality, they are only creating silos of  mediocrity, and all the while isolating their team from other SP folks and thus stifling their proefessional growth.  Now in the extreme, I recently worked at a place where I was brought into build the SP Practice and develop the SP team.  After 11 months, I was not allowed to even know who in teh company did SP.  How well did that work you might ask?  About as well as a loud fart in church during Midnight Mass.

 

May 02
Purpose Driven SharePoint
In many years with SharePoint portal projects I've seen my share of good, solid product deliveries.  I've also seen my share of epic failures.  Regardless of setting, scope, resources, or other "stuff" there is one common factor that if present, ensures success, or if absent, guarantees failure.  That factor is purpose.
We can talk all day long about capacity plans, extensibility, governance, or taxonomy.  But if there is no reason for the users to use the portal in the first place, the implementation is nothing but a qualified exercise of installation.  For a portal project to achieve any level of success, it must have some claim to value within the organization's environment.   A good project team can engineer around poor capacity plans, technical limitations, governance gaps, and weak taxonomy.  But you can't engineer around "uselessness."
 
On the other hand, a portal that has day one “usefulness” will attract (as opposed to force) users; driving adoption; and easing the later stages of implementation (the dreaded training!).  From that I’ve coined the phrase “purpose driven portal.”   And, thanks to a certain pop-book, do feel free to accept or reject a certain ring of religiousness there.   After all, knowledge and information management are sort of the “religion” of the organization when you think about it.
 
Portals are the manifestation of an organization's information management processes (in whole or part, you take what you can).  While I avoid trying to stake a claim within that rarified air of "knowledge management," yes that does come with the meal.  Regardless, the reason portals sound so appealing to organizations in the first place is the promise of facilitating the IM process areas. 
 
Unfortunately, we often see those IM processes mentioned in conjunction with scope statements like "... help with document management..." or "...allow project collaboration..."   Fairly ambiguous functionality declarations, almost as if shuffling documents around the workspace is the whole reason the organization exists!   With no specific reason for users to be “on” the portal, there is no driver to pull them out of the “file-share to email-attachment” mode of operation.  And in short order, the IT department then has yet another “enterprise resource” to maintain which is not even close to any ROI figures quoted in the initial concept layout. 
 
I would argue that IM processes should be the easiest for an organization to map out.  After all, this “information” is the “stuff” by which the organization earns its pay (or whatever the pile of goodies at the end of the day is).  But perhaps as with our own personal foibles in life, the closer one is to the process, the harder it is to articulate what the process is.  So it is up to the SharePoint implementers in many situations to better define, refine, or even drag out those processes. 
 
Over the span of a few posts here, I’ll explore some tactics, techniques and procedures for defining, refining, and, as needed, dragging the processes out of conversations during the early stages of SharePoint implementation.

 

April 08
Why is FEDSPUG changing? What is changing

​Every so often a little revolution is good for the soul.  When I took over FEDSPUG a few years ago we wanted to take a fresh approach to running the user group.  I think we did that with how we were pioneers in using LiveMeeting to run the groups and our format but now it is time for some changes. 

  • The sponsor program is confusing and hard to execute, for example one sponsor level talks about print advertising.  Great idea but hard to do and we really suck at that.  So we are going to a flat sponsor model.  See the sponsorship page for details on that. 
  • The board.  Got lots of folks wtih titles and positions on the board but maybe it is time to bring in some fresh eyes and a new way of looking at things. Only way to do that is clear out the old and make way for the new
  • The site.  We tried to get MS to give us a break on licensing for the portal but that didn't work.  So we are going to use Foundatation for the public side of things and the full up portal with all the bells and whistles will be members only / locked down
  • Meeting time.  the 2 - 4 time slot simply isn't working that well and we get a lot of complaints about it but have stuck with it because it is what the community wanted three years ago.  Time to change that so we will be going to the 6 - 8 time slot
  • Meeting location.  Getting to and from the MS office in Chevy Chase sucks out loud.  Especially for those that live and work in NOVA.  We are going to move the meeitng to a yet to be determined location in NOVA that will be metro accessible.  If there is a lot of desire to retain the MS offce location we might consider alternating. 

If you have idea, whines, complaints or want to volunteer and be part of the solution drop me an email @ msigman@actionet.com  

 

 About this blog

 
About this blog
Welcome to SharePoint Blogs. Use this space to provide a brief message about this blog or blog authors. To edit this content, select "Edit Page" from the "Site Actions" menu.