0

Goal: Use PowerShell to create the default permissions groups (Owners, Visitors, Members) after site collection being created with PowerShell.

I Logged into the Application server with a farm admin account, running PowerShell as admin:

$web = Get-SPWeb $siteCollectionUrl    
$web.CreateDefaultAssociatedGroups("DOMAIN\sitecollectionadmin", "", "")

I am getting below result:

Exception calling "CreateDefaultAssociatedGroups" with "3" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Is there any specific permission I need to grant the account that I am using to run PowerShell so I don't get the Access denied error?

1

This could be a few things:

  1. User isn't a local administrator on the server
  2. User isn't a farm admin
  3. (Most likely) user doesn't have full control on the Web App policy (this would generally be preferred for ease of administration versus assigning the account as a Site Collection Admin)
  • The user that is being used to log into the App Server and run PS was already a local admin on the server (1) and a farm admin (2). I added the account with Full Control on the Web App policy in Central Admin (3) and now when I run CreateDefaultAssociatedGroups I get the error: Exception calling "CreateDefaultAssociatedGroups" with "3" argument(s): "User cannot be found." Is this referring to the user "DOMAIN\sitecollectionadmin" that I want to add in the owners group not being found in the site collection permissions group? It is already a site collection admin. – MLC Dec 20 '18 at 16:49
  • 1
    Since you're on 2016, you should be supplying the claims value for the account, e.g. i:0#.w|domain\username. – Trevor Seward Dec 20 '18 at 17:29
  • When I go into Policy for Web Application on Central Admin, I do see User Name = i:0#.w|domain\username. Is this what you were referring to? – MLC Dec 20 '18 at 18:21
  • That'd be correct. That is the Windows Claims format of the username which is what that method is expecting in your case. – Trevor Seward Dec 20 '18 at 18:36
  • Error resolved by modifying to $web.CreateDefaultAssociatedGroups("", "", "") which successfully created the default groups Visitors, Members and Owners in the site, but added the account that I was using to run the PS in the Owner's group. Just deleted it manually by going to Site Settings>People and Groups>Owners group – MLC Dec 20 '18 at 21:00

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.