I'm attempting to grant permission for sites to AD groups using powershell. The issue I'm having is that while I see the group in the site permissions page, users in that group are not being granted access. If I manually add the same group, those users have access. What I'm seeing is that when I add the group manually, the account name is being converted into a claims token. When I add via powershell the account remains as domain\groupname.
Here is the code I'm running:
$web = Get-SPWeb "https://sharepoint.domain.com" $domainGroup = $web.EnsureUser("DOMAIN\GROUPNAME") $roleDefs = $web.RoleDefinitions["Full Control"] $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($domainGroup) $roleAssignment.RoleDefinitionBindings.Add($roleDefs) $web.RoleAssignments.Add($roleAssignment) $web.Update()
I've also tried using this with the same result:
$roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment("DOMAIN\GROUPNAME", "GROUPNAME@domain.com", "GROUPNAME", "")
This is an SP2013 environment.