2

SharePoint Foundation 2010 SP1 on Windows Server 2008 R2 Std SP1 (Domain Controller) in a simple farm with a single SQL Server 2008 SP1/Windows Server 2008 Std SP2 backend

I realise installing SP on a DC is not advised but I've no alternative.

Trying to run Get-SPWeb -site [site path] I get the following error:

Get-SPWeb : Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) At line:1 char:10 + Get-SPWeb <<<< -site [site path] + CategoryInfo : InvalidData: (Microsoft.Share....SPCmdletGetWeb:SPCmdletGetWeb) [Get-SPWeb], Unauthorize dAccessException + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletGetWeb

I am running as SP_admin. To make sure SP_admin has SharePoint_Shell_Access role on the database, I tried to run Add-SPShellAdmin -username DOMAIN\SP_admin -database [GUID] but then got this error:

Add-SPShellAdmin : You need to have Machine administrator priviliges to run this cmdlet. At line:1 char:17 + Add-SPShellAdmin <<<< -username DOMAIN\SP_admin -database $spcdb + CategoryInfo : InvalidData: (Microsoft.Share...AddSPShellAdmin:SPCmdletAddSPShellAdmin) [Add-SPShellAdm in], SPException + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletAddSPShellAdmin

I have checked:

  • I am running as SP_admin account
  • SP_admin is member of Administrators group
  • SP_admin is member of WSS_ADMIN_WPG group
  • SP_admin has securityadmin role on the SQL Server instance
  • SP_admin has db_owner role on content database

Why is it complaining I need to run as Machine administrator when the account is in the Administrators group? Could it be to do with it being a DC and AD replacing local groups?

http://technet.microsoft.com/en-us/library/ee806878.aspx comments that "Typically, the person that will use the Add-SPShellAdmin cmdlet must be associated with the user account that was used for Setup." and in this case that is true.

Improve this question
2
  • 1
    One more thing, you could mark my reply as answer, if my post has helped you. read more about in FAQs sharepoint.stackexchange.com/faq
    – Falak Mahmood
    Commented Jan 13, 2012 at 23:43
  • I just runned the Sharepoint Power Shell as an admnistrator and it worked! Pd: I'm using Sharepoint 2013
    – user14563
    Commented Jan 31, 2013 at 19:17

2 Answers 2

Reset to default
4

To be allowed to execute PowerShell commands against a specific site collection, the user running the script needs certain access to both the database and every web front end in the farm. Even if you are a farm administrator and you have not been given Shell Admin Access, then you won’t be able to execute farm administrative operation using PowerShell. There are lots of operations that you cannot do via the Central Administration GUI and for which you will require Shell Admin Access.

Run this in the SharePoint PowerShell cmdlet

Add-SPShellAdmin -username testuser

Follow Anders post for more information

If you get errors like “You need to have machine administrator privileges to run this cmdlet”, you need to run the shell as administrator or disable UAC on the server.

If the PS script is launched from Task Scheduler, think of selecting the "Run with highest privileges" checkbox.

Improve this answer
8
  • As I mention in my question, this is the command I have tried to run. I am using the SharePoint Management Shell. I am not using the farm admin account but the installation/setup admin account. If, in order to be able to run Add-SPAdmin, I need privileges additional to those I have listed, what are they?
    – spartanmouse
    Commented Jan 13, 2012 at 10:38
  • Did you make sure that SP_admin is member of local machine administrators?
    – Falak Mahmood
    Commented Jan 13, 2012 at 10:52
  • DCs don't have local groups as these are replaced by Active Directory groups. The account is a member of the Built-In Administrators group in AD.
    – spartanmouse
    Commented Jan 13, 2012 at 11:35
  • You can use the SPShellAdmin cmdlets to help you manage these requirements. When you run the Add-SPShellAdmin cmdlet to add a userid to the SharePoint_Shell_Admin role, you must be mapped to Security_Admin role on the SQL instance and the db_owner role to the relevant databases. You need to run the Add-SPShellAdmin cmdlet for each content database that you want the userid to access.
    – Falak Mahmood
    Commented Jan 13, 2012 at 12:21
  • 1
    Also, If you get errors like “You need to have machine administrator privileges to run this cmdlet”, you need to run the shell as administrator or disable UAC on the server.
    – Falak Mahmood
    Commented Jan 13, 2012 at 12:24
0

For your part about not having rights on certain databases, I found this at http://www.techques.com/question/19-12904/Error---Get-SPWeb-in-Powershell

The account will need permissions on the content database. Just executing:

Add-SPShellAdmin CONTOSO\User1

Will give you access to the configuration database, but not the content database. Also provide access to the content database by giving access to the content database by using the -database parameter

Add-SPShellAdmin -UserName CONTOSO\User1 -database 4251d855-3c15-4501-8dd1-98f960359fa6

You can provide access to all content databases and SharePoint service application databases by using a command like:

Get-SPDatabase | Add-SPShellAdmin CONTOSO\User1
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.