I'm encountering problems adding "some" users(of a certain domain) to a group..

The code works every "domain1" user, but for "domain2" for doesn't:

                using (SPSite scSite = new SPSite(fullsite))

                    using (SPWeb scWeb = scSite.OpenWeb())
                        scWeb.AllowUnsafeUpdates = true;
                        scSite.AllowUnsafeUpdates = true;

                        SPGroup gruppo = scWeb.SiteGroups[groupName];   //FIND
                        SPUser utente = scWeb.EnsureUser(username);    //FIND

Exception is:

You do not have permission to perform this action or access this resource.   at Microsoft.SharePoint.SPGlobal.HandleComException(COMException comEx)
at Microsoft.SharePoint.Library.SPRequest.UpdateMembers(String bstrUrl, UInt32 dwObjectType, String bstrObjId, Guid& pguidScopeId, Int32 lGroupID, Int32 lGroupOwnerId, Object& pvarArrayAdd, Object& pvarArrayAddIds, Object& pvarArrayLoginsRemove, Object& pvarArrayIdsRemove, Boolean bRemoveFromCurrentScopeOnly, Boolean bSendEmail)
at Microsoft.SharePoint.SPUserCollection.UpdateMembers(Object objUpdateInfo, Object objAddIds, Object objRemoveLogins, Object objRemoveIds, Boolean fSendEmail)
at Microsoft.SharePoint.SPUserCollection.AddCollection(SPUserInfo[] addUsersInfo, IEnumerable`1 addUsers)
at Microsoft.SharePoint.SPUserCollection.Add(String loginName, String email, String name, String notes)
at Microsoft.SharePoint.SPGroup.AddUser(SPUser user)

If I manually add the users, everything goes fine..

Context info: that code runs on a Web Service. I also tryed to run it as Console App and Web Part.. But with no changes on the behavior.

The problem I'm facing is probably caused by the 2 domain the machine is trusted with: with 1 domain I have no problem, with the other system fails to add users to group by code but with people picker everithing goes fine..

I begin to think I have a problem with privilegs on AD or something like that.. Any suggestion?

Thank you very much!

  • AllowUnsafe is a terrible idea in this scenario. See my answer here: sharepoint.stackexchange.com/questions/27990/… Also, RWEP is not necessary. That same answer presents a better alternative. If the current user cannot maintain groups, then why force it? You don't describe your scenario, so it is hard to give pertainant advice. Apr 17, 2012 at 13:20
  • In my scenario this part of the method is inside a WS and accessed always by Administrators
    – Ziba Leah
    Apr 17, 2012 at 13:26

1 Answer 1


Ok, the problem was really simple:

The trust between AD was not bidirectional but one way only.

When the trust becomes bidirectional the problem solves automatically!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.