permissions needed for spgroup.adduser() method

Question

I get a strange error when attempting to add a user to a group using sharepoint's powershell:

$spuser = (get-spweb http://server/).ensureuser("DOMAIN\user")
(
Get-SPWeb http://server/site |
Select -ExpandProperty SiteGroups |
Where {$_.Name -EQ "site owners"}
).adduser($spuser)

'Exception calling "AddUser" with "1" argument(s): "<nativehr>0x80070005</nativehr><nativestack></nativestack>"
At line:12 char:1
+ (
+ ~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : UnauthorizedAccessException'

However, this question shows that with the correct permissions (he used site collection admin) this runs correctly. I verified giving myself the same permissions also allowed me to run it. What actual permissions do I need to be able to run this? I'd like to let someone be able to change group memberships for a site without being an admin for the collection

PS: let me know if there's a better way to add users to groups like this, ensureuser() is a strange way to select an spuser object for example (coming from AD powershell)

Answer 1

You should be having Full Control Permission to add/delete users from the group.If you do not have Full Control Site Permission, You will need to be the Group Owner of the specific group where you are trying to add the user.

Reference for Required Permissions

For the time being,You can test the code by adding yourself to a Full Control Site Group(Say Site Owners). You can use the below code to add users to the group.

$site=get-spsite http://sitecollection
#Get Web Object
$web=$site.RootWeb

#Enumerate Site Groups
$web.SiteGroups |select name

#Get User Object
$user=$web.EnsureUser("Domain\User")

#Get group object
$group=$web.SiteGroups["Group Name"]

#Add User to Group
$group.AddUser($user)