Required Permissions in SharePoint Farm for executing PowerShell scripts

By

Before you execute any of the SharePoint Cmdlet you must be sure that you have necessary permissions to execute in the farm. Also you must have access to local WSS_ADMIN_WPG group where you are executing the cmdlet. Also you must be member of the SharePoint_Shell_Access SQL role within the databases your cmdlet calls in to interact with. Some commands also require you to be a member of the local administrator and farm administrator grooups. For ex. to create a web application, you must be a local administrator and farm administrator.

In Regards to adding users to the WSS_ADMIN_WPG group and SharePoint_Shell_Access SQL role, you must not be adding users directly to these groups rather you should use Add_SpShellAdmin cmdlet. This cmdlets accepts optional database name as parameter. If you do not pass this parameter it will add the user to the SharePoint_Shell_Access SQL role in the SharePoint configuration database only.










Above third line of code, it will add Add_SPShellAdmin SQL role in all the SharePoint databases including configuration database. Also you must be farm administrator and you must have securityadmin SQL role in order to execute this cmdlet.

  • Use Remove-SPShellAdmin to reveke access

When it comes to removing access you should use the above command to remove permissions, however it will not remove access to the user from WSS_ADMIN_WPG group on any server. You should remove this access manually. I recommend you should create "SharePoint Shell Access" AD group or groups if you want more fine grained control and grant these group Add-SPShellAdmin access there by avoiding the case users retaining the rights, where they shouldn't.

When we get to the point where we need to execute scripts you may have to set execution policy  to allow scripts to run. You could do this using Set-ExecutionPolicy  by passing the execution policy.

  • Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process
While setting policy for production farms I recommend using policy scope to Process so it does not persist other PowerShell instances.

Comments

Post a Comment

Popular posts from this blog

SharePoint logs and IIS logs backup/archive and Compress to a file

By
The data keeps on growing as the SharePoint Farm being adopted more into the company and customers. It brings more challenges in terms of keeping up with the pace of requests and data administration. We are going to address today one part of that problem which is managing SharePoint LOGS weather it is ULS, Diagnostic and Analytic logging. Also it includes IIS logs. To address this challenge I did wrote a small script to migrate these logs to a different directory and them zip these logs and move to a network storage or to another directory on the local hard drive. Some of the challenges to achieve this were ·         There are IIS logs with same file names in different directories (mainly IIS logs) we need to maintain the directories structure to not miss any logs. ·         The criteria to move these logs out is based on a number of day , like I need to move all the logs 15 or older away from the defaul...
Read more

Optimizing SharePoint 2013 Server Performance - Development Server (single server)

By
Image
There were couple of new services introduced with SharePoint 2013 and raised the hardware resource requirements. Let’s only talk about those process and steps to control the resource consumption when it comes to a single server SharePoint 2013 installation. ·           NodeRunner service ·           Distributed Cache Service ·           Count of Web Application NodeRunner service Use Set-SPEnterpriseSearchService -PerformanceLevel Reduced to reduce the CPU impact the search service has on your test environment. Modify the C:\Program Files\Microsoft Office Servers\15.0\Search\Runtime\1.0\noderunner.exe.config so that it can only consume X amount of RAM. Change the value at <nodeRunnerSettings memoryLimitMegabytes="0" /> to any amount of RAM you like to contain the memory leak. May be 250 MB per instanc...
Read more

PowerShell Cmdlets to Upgrade Content Databases from SP 2010 to 2013

By
Image
In this new article, I will summarize basic  Powershell  cmdelts we have available to upgrade  SharePoint 2010  content databases to  SharePoint 2013 : Before going into detail, you can list available cmdlets by executing the following PowerShell sentence in the  SharePoint 2013 Administration Console : Get-help *SPContentDatabase After executing this sentence, you will have a list with all the cmdlets available: From this list, the cmdlets we are interested in are the following:  Test-SPContentDatabse, Upgrade-SPContentDatabase and Mount-SPContentDatabase. Test-SPContentDatabase  cmdlet allows you to identify any issue or customization you could take into account when upgrading a content database to SharePoint 2013: features installed in the SharePoint 2010 environment that should be in the SharePoint 2013 ones, language packs installed, etc. Below, you can find the general syntax for Test-SPContentDatabase. ...
Read more