Exception calling "CreateDefaultAssociatedGroups" with 3 arguments: Access denied

Question

Goal: Use PowerShell to create the default permissions groups (Owners, Visitors, Members) after site collection being created with PowerShell.

I Logged into the Application server with a farm admin account, running PowerShell as admin:

$web = Get-SPWeb $siteCollectionUrl    
$web.CreateDefaultAssociatedGroups("DOMAIN\sitecollectionadmin", "", "")

I am getting below result:

Exception calling "CreateDefaultAssociatedGroups" with "3" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Is there any specific permission I need to grant the account that I am using to run PowerShell so I don't get the Access denied error?

user6024user6024 · Accepted Answer · 2018-12-19 16:12:41Z

1

This could be a few things:

User isn't a local administrator on the server
User isn't a farm admin
(Most likely) user doesn't have full control on the Web App policy (this would generally be preferred for ease of administration versus assigning the account as a Site Collection Admin)

answered Dec 19, 2018 at 16:12

user6024

The user that is being used to log into the App Server and run PS was already a local admin on the server (1) and a farm admin (2). I added the account with Full Control on the Web App policy in Central Admin (3) and now when I run CreateDefaultAssociatedGroups I get the error: Exception calling "CreateDefaultAssociatedGroups" with "3" argument(s): "User cannot be found." Is this referring to the user "DOMAIN\sitecollectionadmin" that I want to add in the owners group not being found in the site collection permissions group? It is already a site collection admin.
– MLC
Dec 20, 2018 at 16:49
1

Since you're on 2016, you should be supplying the claims value for the account, e.g. i:0#.w|domain\username.
– user6024
Dec 20, 2018 at 17:29
When I go into Policy for Web Application on Central Admin, I do see User Name = i:0#.w|domain\username. Is this what you were referring to?
– MLC
Dec 20, 2018 at 18:21
That'd be correct. That is the Windows Claims format of the username which is what that method is expecting in your case.
– user6024
Dec 20, 2018 at 18:36
Error resolved by modifying to $web.CreateDefaultAssociatedGroups("", "", "") which successfully created the default groups Visitors, Members and Owners in the site, but added the account that I was using to run the PS in the Owner's group. Just deleted it manually by going to Site Settings>People and Groups>Owners group
– MLC
Dec 20, 2018 at 21:00

Add a comment |

1 Answer 1