Scott Jamison

One of the more interesting features of SharePoint 2010 is the Content Organizer, which is great for managing large groups of documents. Specifically, this feature enables you to set up rules to accomlish two things:

1. Automatically creating subfolders to partition groups of items (for scalability — so that no folder has too many items)
2. Automatically moving documents to another location (folder, site, site collection) based on document attributes (so you can dictate automatic placement of content)

Two of the questions I get regularly on the content organizer:

1. Does a user need write permissions on the destination location?  Answer: Actually, no! The content organizer will move the content to the new location whether or not the contributing user has access to the destination location.
2. What account is used for the “Modified By” property on the destination document? Answer: The system will retain the original contributor. (The system does not mark the document as updated by ‘system’ or ‘admin’ or anything like that.)

This is an interesting situation — it means that users can effectively add content into a place where they technically don’t have permissions. Not directly, mind you. But in effect.

To replicate this behavior, you can do a quick test as follows:

1. Create two site collections. (I created one called ‘from’ and one called ‘to’ .)

2. Make sure that Content Organizer is enabled on both root sites by enabling the Content Organizer feature (Site Actions–>Site Settings–>Features) :

 3. Create a user that has write permissions to the ‘from’ Drop Off Library, but no permissions to the ‘to’ site. Mine is called “Joe ReadOnly”. Don’t let the name fool you – he has no access whatsoever on the destination site.

4. Enable a’ send to’ location in central administration. (Central Administration->General Application Settings->External Service Connections->Configure Send to connections:

5. In the Content Organizer Settings (Site Actions–>Content Organizer Settings), check the “Allow rules to specify another site as a target location” option.

6. Create a Content Organizer Rule that moves the document to a target location to “Another content organizer in a differnent site” (selecting the ‘to’ location).

7. Log in as your restricted-permissioned user. Upload a document to the Drop-off Library in the ‘from’ site. The content organizer will move the document to your ‘to’ location, using the original user in the ‘created by’ and ‘modified by’ columns — without that user having any actual permissions to that site.

This entry was posted on Monday, November 1st, 2010 at 5:05 pm and is filed under SharePoint. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.