I have two web applications, web1.myfarm.com and web2.myfarm.com. An AD security group "Domain\Farm_Users" is granted access on both of the web applications. The group members in "Domain\Farm_Users" were able to access the sites for both web applications.

Now i am facing an issue that group members can access web2.myfarm.com with same "Domain\Farm_Users" group but not web1.myfarm.com. They get access denied error while accessing the web1.

Any thoughts?

  • all users getting the access denied? any change to that web application? make sure group is still added to web applications? at which level you add the group?
    – Waqas Sarwar MVP
    Mar 19, 2015 at 12:32
  • Yes all users are getting access denied. No major change to the web application explicitly but we have recently installed some windows security patches on servers. The group is still added at root level on the site. Mar 19, 2015 at 13:12
  • could you pelase try to access the site from farm admin account? also check the logs why it is getting the access denied...also from central admin > upgrade migration > check the status of database if it says upgrade required?
    – Waqas Sarwar MVP
    Mar 19, 2015 at 13:16
  • Site is accessible from all other accounts, other SP and AD groups. Even if we add the group members directly to the site, it works. The DB status is currently "Failed". If i check for servers status, it says upgrade blocked and installation required. Looks like i am missing something big in my farm. But i was missing these component since a long time and issue didn't occur. Not making any sense to me. Mar 19, 2015 at 13:42
  • This is giving me hint your farm is not healthy state and you have to patch it. Sometime problem happen with one Web app or site collection due to upgrade...Also try one more thing, remove the group complety from Site collections/webapp, recycle the app pool of the web app, then re add the group.
    – Waqas Sarwar MVP
    Mar 19, 2015 at 15:27

1 Answer 1


Gotcha. Issue resolved.

  1. Go to site permissions, Click the SP group which contains the AD group, Click the AD group and remove it by clicking Delete User from Site Collection.enter image description here

  2. Add the group back in the SP group. It worked...!

P.S : Previously i was deleting the AD group directly from SP group using "Remove Users From Group" option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.