Goal: Use PowerShell to create the default permissions groups (Owners, Visitors, Members) after site collection being created with PowerShell.

I Logged into the Application server with a farm admin account, running PowerShell as admin:

$web = Get-SPWeb $siteCollectionUrl    
$web.CreateDefaultAssociatedGroups("DOMAIN\sitecollectionadmin", "", "")

I am getting below result:

Exception calling "CreateDefaultAssociatedGroups" with "3" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Is there any specific permission I need to grant the account that I am using to run PowerShell so I don't get the Access denied error?

1 Answer 1


This could be a few things:

  1. User isn't a local administrator on the server
  2. User isn't a farm admin
  3. (Most likely) user doesn't have full control on the Web App policy (this would generally be preferred for ease of administration versus assigning the account as a Site Collection Admin)
  • The user that is being used to log into the App Server and run PS was already a local admin on the server (1) and a farm admin (2). I added the account with Full Control on the Web App policy in Central Admin (3) and now when I run CreateDefaultAssociatedGroups I get the error: Exception calling "CreateDefaultAssociatedGroups" with "3" argument(s): "User cannot be found." Is this referring to the user "DOMAIN\sitecollectionadmin" that I want to add in the owners group not being found in the site collection permissions group? It is already a site collection admin.
    – MLC
    Dec 20, 2018 at 16:49
  • 1
    Since you're on 2016, you should be supplying the claims value for the account, e.g. i:0#.w|domain\username.
    – user6024
    Dec 20, 2018 at 17:29
  • When I go into Policy for Web Application on Central Admin, I do see User Name = i:0#.w|domain\username. Is this what you were referring to?
    – MLC
    Dec 20, 2018 at 18:21
  • That'd be correct. That is the Windows Claims format of the username which is what that method is expecting in your case.
    – user6024
    Dec 20, 2018 at 18:36
  • Error resolved by modifying to $web.CreateDefaultAssociatedGroups("", "", "") which successfully created the default groups Visitors, Members and Owners in the site, but added the account that I was using to run the PS in the Owner's group. Just deleted it manually by going to Site Settings>People and Groups>Owners group
    – MLC
    Dec 20, 2018 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.