2

When trying to add users to a group in a particular web application, users are receiving "Access Denied", even when they should have permission to do so.

While investigating, I found that am able to add users to a group successfully by giving myself "Full Control" in the web application's "Policy for Web Application" setting. After I've added the user to the group, that user can then be removed/re-added by anyone else with the normal privileges (i.e. not having any setting in "Policy for Web Application"). However, the issue still occurs for users who have not previously been added to any group in the web site.

As far as I can tell, there is a problem with the web application accessing the information for a user the first time it's added.

Can anyone assist? I'm honestly not sure where to start with this one.

Edit (15/02/2016):

I can clarify now that I have a bit more knowledge - a group owner in the "owner_group" is trying to add a new user to their "work_group". The owner is not a member of the work group. The owner will get an access denied when trying to add that one new user. However, they can still happily add and remove users who were already previously added.

As part of our intermediate workaround, we (as site collection admins) add the user manually. Then the owner can remove/re-add this user to their group at will. This is obviously not a long term solution though.

|improve this question
  • Can you provide us with ULS logs at the time the error occurs? There will be a "PermissionsMask" log entry and it will indicate "has permissions value, needs permissions value". Just interested in those values. – Trevor Seward Feb 22 '16 at 13:58
  • What does query string in URL look like at /AccessDenied.aspx page? Anything like Type=list? – Aziz Kabyshev Feb 22 '16 at 18:35
4
+100

There is a hidden list in your site collection at /_catalogs/users. See this explanation.

If the user has yet never been assigned to a group, there is no entry for her / him in the list, that means there is no SharePoint user for the account. If the user is assigned first time to any group, the SharePoint user should be created first. If the user, who performes the group maintenance has no permission to create a user, than an "Access Denied" message will be returned. You can create the users in advance (for example, via PowerShell), than the group admins should be already able to add the users to the groups.

|improve this answer
  • Thanks for the info - it appears that the issue is with adding new users to this hidden list. Could there be a permissions problem for this particular list? – DRVR Dec 18 '14 at 0:02
  • If what you say above is true, I would have assumed there should be some kind of automated process that creates the associated metadata for any new users (for example, if they are imported from Active Directory). Surely it wouldn't be a manual process every time there's a new person? Do you know where I would look to verify if there's a problem during the import process? – DRVR Feb 15 '16 at 2:18
  • 1
    Users that haven't been added to the site collection by attempting to visit or by being granted membership, are not imported automatically. You need to implement such automation yourself, either following Todd Carter or on your own with Get-ADUser and New-SPUser commandlets. – Alexey Krasheninnikov Feb 22 '16 at 12:40
  • OK, so it looks like only site collection administrators or site owners can add new users to a site. I previously assumed it was something a group owner should be able to do (after UPS imports accounts from AD), but now know that this is not the case. We will need to speak with the site collection administrators to let them know they need to do this additional step themselves to add new users before group owners can work with them. – DRVR Feb 23 '16 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.