I have an admin account that I want to use to run PowerShell scripts toward a SharePoint site collection that has its own content database. I'm in a bit of doubt what permissions to give the account to be able to run my scripts. According to my tests, a basic requirement is that the account is given permissions with the command Add-SPShellAdmin towards the content database. But that is not enough. I can not run for example the cmdlet New-SPWeb. But if I make the same user Site collection administrator or if it is given Full control on User policy for the web application I can run scripts.
The thing is I thought I had Site collection admin permissions, because my user is member of an AD-group that I use for Site collection administrator permissions on all my site collections. But I still couldn't run PowerShell scripts. I found out it was because of our authentication setup. The AD-group was given site collection administrator rights as the claims adfs federated account c:0-.t|adfsfed|sp-all-shelladmin, meaning I had access when navigating the site collection from my local computer and authenticated through adfs. When I run PowerShell-scripts from the server I do that as the claims windows authenticated account c:0+.w|s-1-5-21-2979246621-1925778976-876374310-104813, this account is not site collection administrator.
The way I see it I have two options here.
- Add the windows claims federated AD-group as site collection administrator. This will result in two groups with the same name as site collection administrators.
- Give the windows claims federated user Full control permission on User Policy on the web application.
So, some of the questions I have are:
- Basically, what permissions are needed to be able to run PowerShell scripts towards a site collection and its content in SharePoint? Are there more alternatives than I have mentioned?
- What are the "pros and cons" of giving permission through user policy rather than site collection administrator?
- Any best practices for how to work with PowerShell-scripting in an SharePoint-environment with multiple authentication providers?