I'm trying to add a windows local group to a Sharepoint Foundation 2013 'Default Owners' group. No matter what I do, it will not work. I get the error 'Sorry, something went wrong. The user does not exist or is not unique'

If I try the exact same activity with a windows local user, it works fine every time. This is also true when I add a user that is a member of the local group that I had tried to add.

I am on Windows Server 2012 R1 with SharePoint Foundation 2013

How do I add a local group to a SharePoint group?

  • did you check the ULS logs for more info about the error?
    – Waqas Sarwar MVP
    Commented Sep 1, 2014 at 16:15
  • I did. There are masses of them and it's almost impossible to know where to begin. Every second can log approx 46 entries. The most common error I see is Category: DistributedCache with Token Cache: Failed to initialize SPDistributedSecurityTokenCache. Additional Info : The client was trying to communicate with the server : net.tcp://VSALM:22233 Commented Sep 1, 2014 at 17:58

3 Answers 3


I think here is the problem, you cannot add the Local Groups( i have not tested as my I am away from my network)

SharePoint groups can contain Windows domain groups (such as domain name\Department_A, where domain name is the name of the Windows domain) or individual users with a user account on the local server or in a Windows domain (such as domain name\user name).


  • I just tested "Domain Local" Security Groups on SharePoint 2013. I can confirm that I could use this group to provide permissions in SharePoint.
    – user43832
    Commented Dec 19, 2018 at 14:20
  • Oh wait, you mean "Local" local. Not "Domain" local. I'll just shhhhh.
    – user43832
    Commented Dec 19, 2018 at 14:25

One way to interpret your question is that you are attempting to add local users and groups to your SharePoint 2010,2013 Farm's site. One may want to do this if they are creating an isolated sharepoint farm accessible by extranet users and do not want to use a.d., live or ADFS accounts.

I was able to get the local users and groups to add by executing the following steps in and admin prompt of SharePoint PowerShell. 1) You must password enable the people picker Stsadm.exe –o setapppassword –password 2) Setting a default group will tell SharePoint to tie the local groups and users into the SharePoint Farm - site -> site settings -> people and groups -> Select group to make default -> settings -> Make default group 3) attempt to add the group or user to a site using people picker - i.e. servername. - The group may not be found right away, but you have now told SharePoint to look locally


1) It may take anywhere from 2-4 hours depending upon application pools to recycle for the above changes to take effect. So be patient, grab lunch and upon return try adding the groups or users multiple times in people picker if they do not resolve.

2) Check the registry key permissions for full control regarding the local groups wss_admin_wpg and wss_wpg. HKLM > Software > Microsoft > Shared Tools > Web Server Extensions > 14.0 or your version number of the hive > Secure


It could be that the membership of the security group has already been cached while the group was still empty.

Please read this article for more information.

The lifetime of tokens issued to logins that use Windows-based login is defined in the "WindowsTokenLifetime" property of the "SecurityTokenServiceConfig" (the default value is 10 hours)

The "LogonTokenCacheExpirationWindow" property (10 minute by default) of the "SecurityTokenServiceConfig" controls when SharePoint will consider that the security token has expired and will ask the user to re-authenticate with the issuer and obtain a new token. SharePoint checks whether the Security token has expired at the start of every request.

for instance, if "WindowsTokenLifetime" = 10 minutes and "LogonTokenCacheExpirationWindow" = 2 minutes

This means that after 10 minutes - 2 minutes = 8 minutes, SharePoint will decide that the security token has expired.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.