question

Romilabaretto-0689 avatar image
0 Votes"
Romilabaretto-0689 asked Romilabaretto-0689 commented

AD group users getting access denied error while accessing the Sharepoint 2016 Site

Hi ,
There is a AD security group which is added to the Visitors group in the SharePoint site . however, the users of this Ad security group don't seem to have the access to the site and the site owners are getting the requests from users and have to manually add users to the Visitors group. Please advise.

office-sharepoint-server-administration
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

CaseyYangMSFT-4714 avatar image
0 Votes"
CaseyYangMSFT-4714 answered Romilabaretto-0689 commented

Hi @Romilabaretto-0689,

Whether this issue happens to all users in this AD security group?

1.Please make sure this AD group is security group, because you are not able to add distribution groups to SharePoint groups.

2.Please check whether these users have permissions or not.
Settings > Site settings > Site permissions > Check Permissions

141924-1.png

3.These users could try to sign out and sign in again to have their security token updated with the new groups.

4.And you could try to add this AD group to SharePoint site directly as a workaround.
Settings > Site settings > Site permissions > Grant Permissions > Show options > Select "Read" permission level

141865-2.png


If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.



1.png (13.7 KiB)
2.png (11.4 KiB)
· 5
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@CaseyYangMSFT-4714 : Below is the response:

This issue is mostly with the new joiners

  1. yes its a security group

  2. yes the user has the permissions through the group also the owners have added the users directly.( the main thing is the owners are getting access requests from the users and they have to grant them access /approve individually. Does it take time for the newly added users to get access to the site through the group?

  3. will check this with a user

  4. will let you know about this workaround.


Thanks for your response. will keep you posted.



0 Votes 0 ·

@CaseyYangMSFT-4714 : About your third point , These users could try to sign out and sign in again to have their security token updated with the new groups: -
The users are getting access denied . Not sure how they can sign out without getting access to the site.

I also checked the farm level configuration of the property:token-timeout for the AD group membership sync and is set to 24hours currently and think this can be the cause that the new joiners are not getting immediate access to the site.

Let me know your thoughts.


0 Votes 0 ·

Hi @Romilabaretto-0689,

About the third point, these users could try to clean browsing data then sign in again. Does these users could login without assess denied error after 24h?

0 Votes 0 ·
Show more comments