3

I want to perform read/write operations on SharePoint 2010/2013 using PowerShell commands remotely. Commands will be New-SP<> , Remove-SP<> and Get-SP<> i.e. all read/write operations on SharePoint users/groups.

What is/are minimum permission(s) required for any user other than Administrator of remote machine ( where SharePoint is residing ) to perform all read/write operations ?

Please provide steps to assign such permissions if possible. Set-PSSessionConfiguration is not helping i.e. Adding any user in Remote Management Users group is not allowing to fire get-spuser command. I am getting following error

Get-SPUser : Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) + CategoryInfo : InvalidData: (Microsoft.Share...SPCmdletGetUser:SPCmdletGetUser) [Get-SPUser], Unauthori zedAccessException + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletGetUser

Improve this question

2 Answers 2

Reset to default
2

As well as the normally documented steps for making PS Remoting work with SharePoint 2010/13, I have found that one additional step is required.

RDP into one of your farm servers and open the SharePoint Management Shell.

$w = Get-SPWebApplication https://my.site.com
$w.GrantAccessToProcessIdentity("mydomain\myusername")

You will need to do this for every web application that you want to access.

Be aware that this will add rights for the given user account against every content database in your web application.

Improve this answer
1
  • This worked, but why were these steps needed? My admin user could run all the Get-SPUser cmdlets locally, but not remotely. He assigned HIMSELF this access when logged locally and then ran the Get-SPUser cmdlets remotely. Commented Dec 7, 2017 at 14:12
0

I think 1st thing to check the SharePoint shell access.

If you do not have membership in the SharePoint_Shell_Access role or WSS_Admin_WPG local group, use the Add-SPShellAdmin cmdlet. When the Add-SPShellAdmin cmdlet is used, the user is added to the WSS_Admin_WPG group in all front-end Web servers and is added to the SharePoint_Shell_Access role. If the target database does not have a SharePoint_Shell_Access role, the role is automatically created. Once the Add-SPShellAdmin cmdlet has been run, the user can run SharePoint 2010 Windows PowerShell cmdlets in a multiple-server farm environment. https://technet.microsoft.com/en-us/library/ee806878(v=office.14).aspx

Please make sure the User has permission on SharePoint( add the user in policy for web app as full read, atleast give the get commands).

Check this blog for step by step.http://blogs.msdn.com/b/varun_malhotra/archive/2010/06/10/configure-power-shell-for-remote-use-of-sp-2010.aspx

Improve this answer
3
  • I have already done these steps for a user but I am getting mentioned error - Access Denied especially for get-spuser command. Commented May 11, 2015 at 9:19
  • can that person run the powershell from the server? Commented May 11, 2015 at 13:55
  • No. That's surprising too. The user is part of following groups Administrator, Remote Management Users, WSS_ADMIN_WPG and WinRMRemoteWMIUsers__ For the same user , get-spuser or new-spuser is failing with same access denied error on server machine itself. get-spsite is executing successfully ! Commented May 12, 2015 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.