I want to perform read/write operations on SharePoint 2010/2013 using PowerShell commands remotely. Commands will be New-SP<> , Remove-SP<> and Get-SP<> i.e. all read/write operations on SharePoint users/groups.

What is/are minimum permission(s) required for any user other than Administrator of remote machine ( where SharePoint is residing ) to perform all read/write operations ?

Please provide steps to assign such permissions if possible. Set-PSSessionConfiguration is not helping i.e. Adding any user in Remote Management Users group is not allowing to fire get-spuser command. I am getting following error

Get-SPUser : Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) + CategoryInfo : InvalidData: (Microsoft.Share...SPCmdletGetUser:SPCmdletGetUser) [Get-SPUser], Unauthori zedAccessException + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletGetUser

2 Answers 2


As well as the normally documented steps for making PS Remoting work with SharePoint 2010/13, I have found that one additional step is required.

RDP into one of your farm servers and open the SharePoint Management Shell.

$w = Get-SPWebApplication https://my.site.com

You will need to do this for every web application that you want to access.

Be aware that this will add rights for the given user account against every content database in your web application.

  • This worked, but why were these steps needed? My admin user could run all the Get-SPUser cmdlets locally, but not remotely. He assigned HIMSELF this access when logged locally and then ran the Get-SPUser cmdlets remotely.
    – grisha
    Dec 7, 2017 at 14:12

I think 1st thing to check the SharePoint shell access.

If you do not have membership in the SharePoint_Shell_Access role or WSS_Admin_WPG local group, use the Add-SPShellAdmin cmdlet. When the Add-SPShellAdmin cmdlet is used, the user is added to the WSS_Admin_WPG group in all front-end Web servers and is added to the SharePoint_Shell_Access role. If the target database does not have a SharePoint_Shell_Access role, the role is automatically created. Once the Add-SPShellAdmin cmdlet has been run, the user can run SharePoint 2010 Windows PowerShell cmdlets in a multiple-server farm environment. https://technet.microsoft.com/en-us/library/ee806878(v=office.14).aspx

Please make sure the User has permission on SharePoint( add the user in policy for web app as full read, atleast give the get commands).

Check this blog for step by step.http://blogs.msdn.com/b/varun_malhotra/archive/2010/06/10/configure-power-shell-for-remote-use-of-sp-2010.aspx

  • I have already done these steps for a user but I am getting mentioned error - Access Denied especially for get-spuser command.
    – BND
    May 11, 2015 at 9:19
  • can that person run the powershell from the server?
    – Waqas Sarwar MVP
    May 11, 2015 at 13:55
  • No. That's surprising too. The user is part of following groups Administrator, Remote Management Users, WSS_ADMIN_WPG and WinRMRemoteWMIUsers__ For the same user , get-spuser or new-spuser is failing with same access denied error on server machine itself. get-spsite is executing successfully !
    – BND
    May 12, 2015 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.