SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm encountering problems adding "some" users(of a certain domain) to a group..

The code works every "domain1" user, but for "domain2" for doesn't:

                using (SPSite scSite = new SPSite(fullsite))

                    using (SPWeb scWeb = scSite.OpenWeb())
                        scWeb.AllowUnsafeUpdates = true;
                        scSite.AllowUnsafeUpdates = true;

                        SPGroup gruppo = scWeb.SiteGroups[groupName];   //FIND
                        SPUser utente = scWeb.EnsureUser(username);    //FIND

Exception is:

You do not have permission to perform this action or access this resource.   at Microsoft.SharePoint.SPGlobal.HandleComException(COMException comEx)
at Microsoft.SharePoint.Library.SPRequest.UpdateMembers(String bstrUrl, UInt32 dwObjectType, String bstrObjId, Guid& pguidScopeId, Int32 lGroupID, Int32 lGroupOwnerId, Object& pvarArrayAdd, Object& pvarArrayAddIds, Object& pvarArrayLoginsRemove, Object& pvarArrayIdsRemove, Boolean bRemoveFromCurrentScopeOnly, Boolean bSendEmail)
at Microsoft.SharePoint.SPUserCollection.UpdateMembers(Object objUpdateInfo, Object objAddIds, Object objRemoveLogins, Object objRemoveIds, Boolean fSendEmail)
at Microsoft.SharePoint.SPUserCollection.AddCollection(SPUserInfo[] addUsersInfo, IEnumerable`1 addUsers)
at Microsoft.SharePoint.SPUserCollection.Add(String loginName, String email, String name, String notes)
at Microsoft.SharePoint.SPGroup.AddUser(SPUser user)

If I manually add the users, everything goes fine..

Context info: that code runs on a Web Service. I also tryed to run it as Console App and Web Part.. But with no changes on the behavior.

The problem I'm facing is probably caused by the 2 domain the machine is trusted with: with 1 domain I have no problem, with the other system fails to add users to group by code but with people picker everithing goes fine..

I begin to think I have a problem with privilegs on AD or something like that.. Any suggestion?

Thank you very much!

share|improve this question
AllowUnsafe is a terrible idea in this scenario. See my answer here:… Also, RWEP is not necessary. That same answer presents a better alternative. If the current user cannot maintain groups, then why force it? You don't describe your scenario, so it is hard to give pertainant advice. – Paul Schaeflein Apr 17 '12 at 13:20
In my scenario this part of the method is inside a WS and accessed always by Administrators – Ziba Leah Apr 17 '12 at 13:26
up vote 0 down vote accepted

Ok, the problem was really simple:

The trust between AD was not bidirectional but one way only.

When the trust becomes bidirectional the problem solves automatically!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.