Search Result shows from sites where user does not have permission

Question

What I have?

I have a SharePoint 2010 web application with FBA configured and it is exposed to Internet. The root site collection has a huge hierarchy and each site has document libraries with many documents.

There are more than 10 site groups defined and some of them has access only to some sites.

What problem am I facing?

Everything was working fine and suddenly I am facing a problem in Enterprise Search.

When a user searches, the search result displays everything (including the site where user does not have permission) and clicking on a result it either opens the item (page/document) or shows Access denied error depending on whether the user has permission on that item.

Can someone tell me why is this happening?

Answer 1

We finally figured out the problem with this one.

We had given Full Read permissions to NT AUTHORITY\Authenticated Users for All zones in User Policy of the web applications in question. I am not sure of the reason for giving this permission. We removed it. Then, a full crawl fixed the issue.

Thanks!