Forum Discussion

LadislavStupak's avatar
LadislavStupak
Brass Contributor
Aug 13, 2021
Solved

PowerShell - SharePoint Server - User Profiles - Access denied

Dear Colleagues,

 

I can not access User Profiles from SharePoint 2019 on premise through PowerShell.

 

I am DB Owner on the User Profile Database and Loacal Administartor on the Windows Servers for SharePoint Frontend and for SharePoint Database. I am Administrator in the User Profile Services.

 

I can access the User Profiles with the identical code written in a Farm Solution.

 

Here is the code:

 

Param (
[string]$WebUrl
)

Add-PSSnapin "Microsoft.SharePoint.PowerShell" -ErrorAction SilentlyContinue

$Assemblies = ("System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a", "Microsoft.SharePoint, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c", "Microsoft.Office.Server, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c", "Microsoft.Office.Server.UserProfiles, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c")

$Code = @"

using System;
using System.Collections;
using System.Collections.Generic;
using Microsoft.Office.Server.UserProfiles;
using Microsoft.SharePoint;

namespace TestGetAllUserProfilesWithElevatedPrivileges
{
public static class Utility
{
public static List<string> GetAccountNames(string webUrl)
{
List<string> accountNames = new List<string>();

if (!string.IsNullOrEmpty(webUrl))
{
SPSecurity.RunWithElevatedPrivileges(delegate () {

try
{
using (SPSite site = new SPSite(webUrl))
{
SPServiceContext serviceContext = SPServiceContext.GetContext(site);

if (serviceContext != null)
{
UserProfileManager userProfileManager = new UserProfileManager(serviceContext);

if (userProfileManager != null)
{
IEnumerator userProfiles = userProfileManager.GetEnumerator();

if (userProfiles != null)
{
while (userProfiles.MoveNext())
{
UserProfile userProfile = userProfiles.Current as UserProfile;

if (userProfile != null)
{
string accountName = userProfile.AccountName;

if (!string.IsNullOrEmpty(accountName))
{
accountNames.Add(accountName);
}
}
}
}
}
}
}
}
catch (Exception ex)
{
string errorMessage = ex.Message + " " + ex.ToString();

accountNames.Add(errorMessage);
}
});
}

return accountNames;
}
}
}
"@

Add-Type -TypeDefinition $Code -Language CSharp -ReferencedAssemblies $Assemblies

$accountNames = [TestGetAllUserProfilesWithElevatedPrivileges.Utility]::GetAccountNames($WebUrl)

if ($accountNames) {

foreach($accountName in $accountNames) {

if ($accountName) {

Write-Host $accountName
}
}
}

 

And here is the error message:

 

at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   at Microsoft.Office.Server.UserProfiles.IProfileDBCacheService.GetUserData(UserSearchCriteria searchCriteria)

   at Microsoft.Office.Server.UserProfiles.ProfileDBCacheServiceClient.<>c__DisplayClass3.<GetUserData>b__0(IProfileDBCacheService channel)

   at Microsoft.Office.Server.Infrastructure.ChannelInvoke`1.ExecuteOnChannel(String operationName, Action`1 codeBlock, ChannelInvokeSettings channelInvokeSettings)

   at Microsoft.Office.Server.UserProfiles.MossClientBase`1.ExecuteOnChannelWithRetries(String operationName, Action`1 codeBlock)

   at Microsoft.Office.Server.UserProfiles.ProfileDBCacheServiceClient.ExecuteOnChannel(String operationName, CodeBlock codeBlock)

   at Microsoft.Office.Server.UserProfiles.ProfileDBCacheServiceClient.GetUserData(UserSearchCriteria searchCriteria)

   --- End of inner exception stack trace ---

   at Microsoft.Office.Server.UserProfiles.ProfileDBCacheServiceClient.GetUserData(UserSearchCriteria searchCriteria)

   at Microsoft.Office.Server.UserProfiles.UserProfileCache.GetBulkUserData(UserProfileManager objManager, String searchColumn, IList searchList)

   at Microsoft.Office.Server.UserProfiles.UserProfileCache.GetBulkUserProfiles(UserProfileManager objManager, String searchColumn, IList searchList, Boolean includeNullsForUnresolvableUsers, Int64& lFai

ledCount)

   at Microsoft.Office.Server.UserProfiles.UserProfileCache.GetBulkUserProfiles(UserProfileManager objManager, List`1 userIdList, Boolean includeNullsForUnresolvableUsers, Int64& lFailedCount)

   at Microsoft.Office.Server.UserProfiles.ProfileEnumerator`1.PopulateUserProfileQueue(IList userSearchList)

   at Microsoft.Office.Server.UserProfiles.ProfileEnumerator`1.PopulateQueue()

   at Microsoft.Office.Server.UserProfiles.ProfileEnumerator`1.MoveNext()

   at TestGetAllUserProfilesWithElevatedPrivileges.Utility.<>c__DisplayClass2.<GetAccountNames>b__0()

 

Thank you for your help.

 

With best regards

Ladislav Stupak

  • 1. Add-SPShellAdmin

    I ran Add-SPShellAdmin:

    Get-SPDatabase | ? {$ _. Name -eq "UserProfile Database Name"} | Add-SPShellAdmin -Username Domain\LoginName

    On sharepointcommunity.de I have received a hint for it:
    http://sharepointcommunity.de/forums/p/45151/110614.aspx#110614

    2. User Profile Service Application - Permissions

    I have assigned myself Full Control rights in Central Administration in the User Profile Service Application under Sharing - Permissions.

    (As an administrator, I had already set myself up in the User Profile Service Application. That was not enough.)



    Now I can run the scripts through the user profiles.

1 Reply

  • 1. Add-SPShellAdmin

    I ran Add-SPShellAdmin:

    Get-SPDatabase | ? {$ _. Name -eq "UserProfile Database Name"} | Add-SPShellAdmin -Username Domain\LoginName

    On sharepointcommunity.de I have received a hint for it:
    http://sharepointcommunity.de/forums/p/45151/110614.aspx#110614

    2. User Profile Service Application - Permissions

    I have assigned myself Full Control rights in Central Administration in the User Profile Service Application under Sharing - Permissions.

    (As an administrator, I had already set myself up in the User Profile Service Application. That was not enough.)



    Now I can run the scripts through the user profiles.

Resources