Get-SPWeb: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Question

I'm having issue with Get-SPWeb:

I did everything suggested at

Error - Get-SPWeb in Powershell

but still not working. weird thing is: it worked before. Did MS change something?

the account i use is in Farm Admin group, but not the account used to install sharepoint.

then I found this: http://technet.microsoft.com/en-us/library/cc263291.aspx

Farm Administrators group Members of the Farm Administrators group have Full Control permissions to and responsibility for all servers in the server farm. Members can perform all administrative tasks in Central Administration for the server or server farm. They can assign administrators to manage service applications, which are instances of shared services. This group does not have access to individual sites or their content.

So, I have to grant user policy for each web app (full read), now get-spweb works fine.

I'm just curious: why farm admin does not have the access to individual sites? kind of weird, isn't it?

Any insight opinions?

thanks

Answer 1

If all you want is to use the SP2010 Management Shell without restrictions, have you tried to add the user account to the Sharepoint_Shell_Access (or, as Microsoft calls it: to configure least privilege rights to manage SharePoint with Windows PowerShell)?

Try this:

Run SharePoint 2010 Management Shell as Domain Admin and run the following commands:

$spsite = get-spsite "http:// [your sharepoint url, like intranet.company.com] "
$spcd = get-spcontentdatabase WSS_Content_Intranet [or whatever is your webapp's name]
add-spshelladmin -username [domain\username] -database $spcd

This should enable you to run your PowerShell commands while logged in as Farm or SharePoint Administrator.

FYI: I'm still working on getting this set up properly myself, so I might just revise this answer later - depending on what I find out. When I took these steps during a MOC on the lab machines of the Microsoft Course, it solved my problems.

Answer 2

Farm Admins manage the farm's day to day activities and should NOT have access to the data unless there is a business need. This is primarily for security purposes as the data itself can be confidential or even secret in nature. Farm admins can always grant themselves access to this but they should not have it by default.

In our case, farm admins are also internal Tier 3 SharePoint Support and as such need to be able to access site data in order to troubleshoot issues so we have done exactly what you did. However, we have also enabled full auditing on all SharePoint sites so anything a farm admin does can also be tracked. We also have automated systems that comb through the audit data and to find security and access anomalies and it then reports those to Site Owners so if someone happens to be looking at something they shouldn't, it will likely be spotted and reported.

Answer 3

You need in Central Administration in Manage Web Application for each web-application give for account in User Policy full access.

Answer 4

I had the same problem and worked for me when I added my user as Site Collection Administrator.