Hi, Cathal - the portal was initially set to Private. (It is now temporarily "None")

The user logs in each visit - not a persistent cookie.

Using a mixture of the default DNN provider and the Active Directory provider (Horton/DNN version, not third party).

The account which I used to log in and test was a Windows account that was not checked as authorized, and this user could see all.

Another person was able to register (just this morning, when set to Private) on the site but account was not set to Authorized.

The concern was that if an unauthorized person could see all content, perhaps this person could as well. However, now that I am describing it, I realize I tested with an AD account and assumed same for DNN membership provider account.

Could be differences. But shouldn't an unauthorized AD account still be unable to log on and view all?

I will test again with a DNN membership provider account.

---

pmgerholdt