I am in the farm admin group and I think SharePoint prevents admin to run a workflow and gives "suspended" status for a given workflow. But there are cases where I need to be able to run workflow. for example, If I fill out a leave request with HR then a workflow runs under the created by user account and in my case it will fail. What is the remedy for this issue?

Thanks in advance.

  • The remedy (and highly recommended) is to not have your private account in the farm admin group. You sould rather have a private admin account in that group that you can use when you need to! – Robert Lindgren Jun 9 '15 at 16:14
  • 1
    Good Point. Turns out my normal account is not part of the Farm Admin group rather it's AD group which is added to SharePoint group. But if I add a normal user directly to sharpoint group then that user can run the workflow. Is there an issue with workflow 2013 getting users from AD ? – Kevin Short Jun 9 '15 at 16:34
  • 1
    I added my userid to the contribute group and workflow went through. sounds like there is an issue with workflow 2013. adding Everyone or domain\domain users does not help either. very frustrating. What is the fix? – Kevin Short Jun 9 '15 at 17:15

Basically you have to include the AD Groups in the user profile sync connection.

In User Profile Service Application "UPSA" under user profile sync connection add new connection to AD.

You need to add users and ad groups.

☑ OU Name

✓ OU Name






Look out for green checkmarks(✓). They need to be connected to OU.

For exapmle OU>Users and OU> AD Group1>Group Name, all need to be connected (checked with green checkmarks).

How to use Active Directory groups with workflows?

Add application pool account to group “Windows Authorization Access Group” in Active Directory (Under Builtin).

If the users participating in the workflows have been added to the SharePoint site via Active Directory groups, SharePoint has to update the user’s security token periodically by connecting to the domain controller. By default, the token times out every 24 hours. But if the application pool account did not have the right permissions on the domain controller to update the user’s token, user will keep getting the access denied error. The error was intermittent because when the user browsed to any page other than the workflow form, the token was getting updated successfully.

You can try to fix it through granting the application pool account the appropriate permission by adding the account to the group “Windows Authorization Access Group” in Active Directory.


After that run:

1.Sync User Profile Service Application > Start Profile Synchronization(Full).

2.Full/incremental crawl (Central Administration > Manage Service Applications > Search > Content Source) - sps3://YOURSITE

| improve this answer | |
  • eVT: Thanks for the detailed information. i will work on this. I guess I will add a secondary connection just for AD group so I dont mingle users with group. What do you think? – Kevin Short Jun 10 '15 at 14:20
  • You can try with the second connection for AD groups if you have already first (primary) connection for users. – Marko Tica Jun 11 '15 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.