When trying to add users to a group in a particular web application, users are receiving "Access Denied", even when they should have permission to do so.
While investigating, I found that am able to add users to a group successfully by giving myself "Full Control" in the web application's "Policy for Web Application" setting. After I've added the user to the group, that user can then be removed/re-added by anyone else with the normal privileges (i.e. not having any setting in "Policy for Web Application"). However, the issue still occurs for users who have not previously been added to any group in the web site.
As far as I can tell, there is a problem with the web application accessing the information for a user the first time it's added.
Can anyone assist? I'm honestly not sure where to start with this one.
I can clarify now that I have a bit more knowledge - a group owner in the "owner_group" is trying to add a new user to their "work_group". The owner is not a member of the work group. The owner will get an access denied when trying to add that one new user. However, they can still happily add and remove users who were already previously added.
As part of our intermediate workaround, we (as site collection admins) add the user manually. Then the owner can remove/re-add this user to their group at will. This is obviously not a long term solution though.