Currently SP 2013 site has domain1\abc AD group but this has to be updated/add new group domain2\xyz using powershell for 500 site collections. will the identity claim be generated if the group is created from powershell.

  • Your question is poorly formulated, but let me see if I got it: You want to copy a AD group from a different domain? Or you want to add a new ad group to domain1\abc? – ranbo Jan 30 '17 at 18:24
  • Currently I have old and new AD groups and users are also migrated from old to new group (where domain and name are changed). Now the SP site has old AD group, how can I add new AD group using powershell for about 100 sites – SPBeginner Jan 30 '17 at 18:31
  • is this similar to what you need? tharindupg.blogspot.com.br/2015/01/… – ranbo Jan 30 '17 at 18:37
  • No Rafael, I need powershell script to add the newly created AD group to SharePoint 2013 SP group in 100 sites..later I can run the PS script to remove old AD group – SPBeginner Jan 30 '17 at 18:46
  • ok, so this new group is already synced with sharepoint? when you are adding permissions you can pull it? what kind of permission you want to give to this group in the 100 sites? – ranbo Jan 30 '17 at 18:48

See if this script works out for you

   function AddAccountToAllSites ($siteURL, $accountName, $permLevel, [switch]$skipRootSite, $newGroupDescription)
        #Get Site Collection
        $site = Get-SPSite $siteURL

        #Check if the accountName variable contains a slash - if so, it is an AD account
        #If not, it is a SharePoint Group
        $rootWeb = $site.RootWeb
        if ($accountName.Contains("\")) { $account = $rootWeb.EnsureUser($accountName) }
        else {
            #If the SharePoint Group does not exist, create it with the name and description specified
            if (!$rootWeb.SiteGroups[$accountName])
                $rootWeb.SiteGroups.Add($accountName, $rootWeb.CurrentUser, $rootWeb.CurrentUser, $newGroupDescription)
            $account = $rootWeb.SiteGroups[$accountName]

        #Step through each site in the site collection
        $site | Get-SPWeb -limit all | ForEach-Object {

            #Check if the user has chosen to skip the root site - if so, do not change permissions on it
            if (($skipRootSite) -and ($site.Url -eq $_.Url)) { write-host "Root site" $_.Url "will be bypassed" }
            else {
                #Check if the current site is inheriting permissions from its parent
                #If not, set permissions on current site
                if ($_.HasUniqueRoleAssignments) {

                    $assignment = New-Object Microsoft.SharePoint.SPRoleAssignment($account)
                    $role = $_.RoleDefinitions[$permLevel]

                    write-host "Account" $accountName "added to site" $_.Url "with" $permLevel "permissions."
                else {
                    write-host "Site" $_.Url "will not be modified as it inherits permissions from a parent site."
        #Display completion message and dispose of site object
        write-host "Operation Complete."


here is what you asked secondly

$SiteCollection = "http://site/sitecollection"
$ADGroupName = "domain\adgroup"
$SPGroupName = "My Test Group A1"
$SPGroupDescription = "Test Group A1’s Description"
$SPGroupPermission = "Read"

#Start of script
$site = Get-SPWeb $SiteCollection

#Check if the group already exists
if ($site.SiteGroups[$SPGroupName] -eq $null)

#Ensure Group/User is part of site collection users beforehand and add them if needed

# Get the AD Group/User in a format that PowerShell can use otherwise there will be a string error
$ADGroupSPFriendly = $site | Get-SPUser $ADGroupName

#Create the SharePoint Group – Group Name, Group Owner, Group Member, Group Description. Can’t add AD group yet…
$NewSPGroup = $site.SiteGroups.Add($SPGroupName, $site.CurrentUser, $site.CurrentUser, $SPGroupDescription)
$NewSPAccount = $site.SiteGroups[$SPGroupName]

#Assign the Group permission
$GroupAssignment = New-Object Microsoft.SharePoint.SPRoleAssignment($NewSPAccount)
$GroupRole = $site.RoleDefinitions[$SPGroupPermission]

#Add the AD Group/User to the group, can’t be done during group creation when using Powershell otherwise errors so is done now.
Set-SPUser -Identity $ADGroupSPFriendly -Web $SiteCollection -Group $SPGroupName
  • I also have 1 more question, refer to the link sharepointfire.com/2013/11/… .... if we click on an AD group that is already in SP we get to know its identity claim so does this code be generated automatically when the AD group is added to SP through the script given by you. – SPBeginner Jan 30 '17 at 19:03
  • I'm sorry, I didn't understand what is your question. Can you rephrase it? – ranbo Jan 30 '17 at 19:05
  • can you provide me the script to add an AD group to an existing SP group for a single site collection – SPBeginner Jan 31 '17 at 10:50
  • just edited my answer with that – ranbo Jan 31 '17 at 10:59
  • $ADGroupSPFriendly = $site | Get-SPUser $ADGroupName Get-SPUser : You must specify a valid user object or user identity.Invalid Argument error – SPBeginner Jan 31 '17 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.