Tag Archives: access denied

Access Denied Content Type Policy Templates

access denied content type policy templates

I was getting access denied error while creating content type policy template in sharepont online. i tried the solution as below to resoleve the issue. let’s disucss how to resolve access denied content type policy templates error. the solution is applicable for the error Access denied uploading template to content type.

  • Navigate to site settings in sharepoint and click on “content type policy template” to create a custom policy template.
site settings option in sharepoint online for the error access denied content type policy templates
site settings in sharepoint

Error “access denied content type policy templates” screenshot as below

access denied content type policy templates
access denied error while creating content type policy templates

Solution

Enable below settings in sharepoint admin center.

  • Allow users to run custom script on personal sites
  • Allow users to run custom script on self-service created sites
enable custom script sharepoint online
enable custom script sharepoint online

Enable Custom script in site

next step to enable cutom script in site using powershell

Connect-SPOService -Url <sharepoint admin center url>
Set-SPOSite -Identity <site url> -DenyAddAndCustomizePages 0

watch the video below to see all steps for your reference

Advertisements
Access Denied Error after migrating to SharePoint 2013

Access Denied Error after migrating to SharePoint 2013

Access Denied Error after migrating to SharePoint 2013

Scenario:

We were working for a client, they had many groups and we had to build a collaboration portal for all the groups. Key thing was few sites of some groups were already present in SharePoint 2010 in different standalone servers. Migration was a key thing here as the existing sites has huge data, and huge user base.

The Requirement was to build a portal /web application which will have migrated sites and new set of sites as per agreed site structure. According to the agreed architecture and design we created a new web application and started building the site hierarchy.

As part of this we followed the regular approach database detach –attach method and migrated the existing SharePoint 2010 site .Migration was successful and we were able to access the site  with the system account. Later we tried with couple of site admin accounts, to our surprise we were getting “ACCESS DENIED” with any other user id.

Background:

By default when we create a web application in SharePoint 2013, it gets created with Claims authentication. When we migrate the content DB to 2013, it recognizes the user account only in this format i:0#.w|domainusername . Though it’s an AD account it no more recognizes the DomainUserName format.

SharePoint assumes all users to be claim users and renders them so. Therefore, a normal windows user – “DomainUserName” appears as “i:0#.w|DomainUserName”. Moreover, it uses the username in this same format to check for its permissions but does not find a matching entry for the user as the database has windows users – “DomainUserName”. So, the site will give you an access denied.

Note that the System Account will work since its “DomainUserName” is never used and System Account is a keyword used by SharePoint for the application pool identity. Therefore, it remains unaffected.

Solution:

In brief the share point 2010 site which needs to be migrated should be converted to claims format and then migrate it to 2013. But a word of caution , do not directly change the SP 2010 site to claims format in a production environment as it will not allow existing windows accounts to login and existing SharePoint 2010 site will be no more operational.

Below power shell script converts classic mode site to claims mode:

Power shell script

This script converts user accounts to claims format:

Script for converting user accounts to claims format

On executing the first script (to enable claims authentication) the SharePoint Content Database is made ready for claims based authentication but the already existing site users were windows users, are not “migrated” to be understood by claims authentication.

We use the second script to “migrate” the users. MigrateUser($true) will convert all user accounts to claims format. After running this script user accounts are converted in the database to claims format, therefore, user names are read correctly by SharePoint therefore, permissions for users are associated correctly by SharePoint hence the site permissions work correctly.

Note:

By any chance if you execute these scripts directly in productions, by executing $webapp.MigrateUsers($false) will not convert user accounts to windows mode, rather it will throw an exception. Make sure you have a temporary environment built where you execute the above scripts. Also note that these scripts are running on Web Applications so they will affect all site collections in that web application