I'm attempting to grant permission for sites to AD groups using powershell. The issue I'm having is that while I see the group in the site permissions page, users in that group are not being granted access. If I manually add the same group, those users have access. What I'm seeing is that when I add the group manually, the account name is being converted into a claims token. When I add via powershell the account remains as domain\groupname.

Here is the code I'm running:

$web = Get-SPWeb "https://sharepoint.domain.com"
$domainGroup = $web.EnsureUser("DOMAIN\GROUPNAME")
$roleDefs = $web.RoleDefinitions["Full Control"]
$roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($domainGroup)

I've also tried using this with the same result:

$roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment("DOMAIN\GROUPNAME", "GROUPNAME@domain.com", "GROUPNAME", "")

This is an SP2013 environment.


can you try below which worked for me.

$ownerGroup = $web.SiteGroups["GROUPNAME"]

which gets the collection of cross-site groups for the site collection.

Instead of using

$domainGroup = $web.EnsureUser("DOMAIN\GROUPNAME")

your role assignment object is fine this way -

$roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($domainGroup)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.