0

I have a scenario where I need to kick off a 2013 SPD workflow from a powershell script. This should be possible using the StartWorkflowOnListItem method. My script is as follows:

Add-PSSnapin "Microsoft.SharePoint.PowerShell"
$sourceWebURL = 'http://devserver'
$TargetWorkflow = 'AutoUpdateAppointmentStatus'
$spSourceWeb = Get-SPWeb $sourceWebURL
$spSourceList = $spSourceWeb.Lists['ServiceAppointments']
$wfm = New-object Microsoft.SharePoint.WorkflowServices.WorkflowServicesManager($spSourceweb)
$sub = $wfm.GetWorkflowSubscriptionService()
$WF = $sub.EnumerateSubscriptionsByList($spSourcelist.ID) | Where-Object {$_.Name -eq "$TargetWorkflow"}
$wfis = $wfm.GetWorkflowInstanceService()
$object = New-Object 'system.collections.generic.dictionary[string,object]'
$object.Add("itemId", 42);
$object.Add("WorkflowStart", "StartWorkflow");
$wfis.StartWorkflowOnListItem($WF, 42, $object)

(In this example I am trying to run the workflow on an item in the list with ID 42)

Now originally when I tried this, I was doing so under a user designated as the System Account. As I know, workflows will not kick off from the system account, and there were a couple ULS messages alerting me to this. Therefore, I made a new user called "spshelluser". I defined this user as an owner of the SP site and made them an SPShellAdmin with permission for the site's content database. (Are there any other databases which this account needs permission granted for?)

When attempting to run the script as spshelluser in a non-elevated powershell, I get the following error upon execution of the StartWorkflowOnListItem method:

Exception calling "StartworkflowOnListItem" with "3" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Next, I tried to run the script as spshelluser in a local-admin elevated powershell. When executing the script, I get clean, error-free returns. Upon execution of the StartWorkflowOnListItem method it returns a Guid to me, however no workflow ever fires. I'll note that I am able to start the workflow manually using the spshelluser account via Sharepoint's web user interface, just not using this StartWorkflowOnListItem method. This is what the ULS logs look like for everything powershell related upon firing that method.

03/04/2015 14:10:52.26 powershell.exe (0x3CA8) 0x184C SharePoint Foundation Upgrade ajyw6 High 03/04/2015 14:10:52.26 powershell (0x3CA8) 0x184C SharePoint Foundation Upgrade SPHierarchyManager ajyw6 DEBUG [SPTree Value=SPSite Url=http://devserver] added to dependency cache by lookup 00000000-0000-0000-0000-000000000000 e8467162-46e6-0003-4bd4-51e8e646d001

03/04/2015 14:10:52.29 powershell.exe (0x3CA8) 0x184C SharePoint Foundation Upgrade ajyw6 High 03/04/2015 14:10:52.29 powershell (0x3CA8) 0x184C SharePoint Foundation Upgrade SPHierarchyManager ajyw6 DEBUG [SPTree Value=SPSite Url=http://devserver] added to dependency cache by lookup 00000000-0000-0000-0000-000000000000 e8467162-46e6-0003-4bd4-51e8e646d001

03/04/2015 14:10:52.36 powershell.exe (0x3CA8) 0x184C SharePoint Foundation Monitoring b4ly High Leaving Monitored Scope (EnsureListItemsData). Execution Time=118.1846 e8467162-46e6-0003-4bd4-51e8e646d001

03/04/2015 14:10:52.53 powershell.exe (0x3CA8) 0x184C SharePoint Foundation Monitoring b4ly High Leaving Monitored Scope (EnsureListItemsData). Execution Time=17.938 e8467162-46e6-0003-4bd4-51e8e646d001

03/04/2015 14:10:52.94 powershell.exe (0x3CA8) 0x2874 SharePoint Foundation Topology e5mc Medium WcfSendRequest: RemoteAddress: 'net.pipe://localhost/SecurityTokenServiceApplication/appsts.svc' Channel: 'Microsoft.SharePoint.IdentityServices.IApplicationSecurityTokenServiceContract' Action: 'http://schemas.microsoft.com/sharepoint/2011/05/securitytokenservice/IApplicationSecurityTokenServiceContract/Issue' MessageId: 'urn:uuid:257af61e-414e-4976-accd-c1c9fcfa28ba'

03/04/2015 14:10:52.98 powershell.exe (0x3CA8) 0x2874 SharePoint Foundation General aipzv High Unable to write service call usage entry.

03/04/2015 14:10:52.98 powershell.exe (0x3CA8) 0x2874 SharePoint Foundation Application Authentication aiv3e High Self-issued token request for '00000005-0000-0000-c000-000000000000/devserver:12291@f5d95061-4f7f-4166-a877-d95be879be8e' succeeded.

03/04/2015 14:10:53.00 powershell.exe (0x3CA8) 0x2874 SharePoint Foundation Claims Authentication airzh Medium Using UPN 'spshelluser@mc.SECRET.com' for SMTP claim

Any ideas on what's happening? The ULS logs don't reveal much. Not sure what's going on with that "Unable to write service call entry".

I thought I read somewhere that workflows will fail to kick off from elevated powershell instances. Is that the case? If so, I'll need to figure out what the proper permissions should be for me spshelluser account. (Haven't found a straight answer on this yet). Do I have to reinstall the 2013 workflow service such that it is not owned by builtin/administrators but a domain group instead?

Thanks in advance for comments and suggestions.

  • Does your current user have a Profile created for him? – Choggo Mar 4 '15 at 20:02
  • Yes. I had added spshelluser to the sharepoint site and am able to log with the user. When logged in, SP shows my username as "spshelluser" in the upper right which indicates to me that this user is not recognized as a System Account. (that's good) – syagla Mar 4 '15 at 21:00
  • 2
    Sp2013 workflow requires that The user have a profile created in the user profile service application – Choggo Mar 4 '15 at 21:02
  • I'll check that. I think we have been having some issues related to the user profile service application come to think of it. – syagla Mar 4 '15 at 21:06
1

Under manage site features activate "Workflows can use app permissions" feature and it should solve your problem.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.