SSOM C# UnAuthorize Exception while using SPSite.Usage.Storage

ASR 671

Hi,
I am using SP2013 and trying to fetch SPSite.Usage.Storage while traversing web application. I have two users both under the farm admin group. But it is working for one user and not working for other.
I also go to central admin -> then click on web application -> then user policy. Here also both users have similar permission which is Full Read.
Still this command working for one user whereas not working for other one.

2 answers

MichaelHan-MSFT 18,016 Reputation points

2021-11-10T07:24:58.927+00:00
Hi @ASR ,

To get SPSite.Usage.Storage data, the user need to have full control permission for the site.

Could it that one user is the site collection administrator or he has full control to the site?

Please refer to this article for more:

https://learn.microsoft.com/en-us/SharePoint/sites/user-permissions-and-permission-levels.

------------
Update-----------
Also make sure the user is a managed account, to check if a user is managed account or not, you can refer to the following:

Go to Central Administration.

Click Security and then select Configure Managed Accounts.

The list of existing managed accounts is displayed.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
ASR 671 Reputation points

2021-11-10T08:32:37.587+00:00

Hi @MichaelHan-MSFT ,
I provided full access at the WebApplication level to both users. To achieve this, I go to central admin-> then click on web application -> then user policy -> and here I give full read permission to both the users. Do we need to give any other permission?
I am traversing a web application for this I am using the below code. Working fine with the user provided by IT team. But for other user after giving required privileges it is not working.

SPSecurity.RunWithElevatedPrivileges(delegate ()
{
SPWebApplication webApplication = SPWebApplication.Lookup(new Uri(webApplicationUrl));
foreach (SPSite sps in webApplication.Sites)
{
if (sps != null)
{
string size = FormatSize(sps.Usage.Storage);

foreach (SPWeb subSite in sps.RootWeb.Webs) { if (subSite != null) { //Do Something } } } } });

MichaelHan-MSFT 18,016 Reputation points

2021-11-10T09:33:00.087+00:00

You could try to give full control permissions. Check if it works.

ASR 671 Reputation points

2021-11-10T09:53:08.99+00:00

@MichaelHan-MSFT
No not working.

MichaelHan-MSFT 18,016 Reputation points

2021-11-11T07:37:17.627+00:00

@ASR ,

You could try to go to the site permissions page and check the permission for the user. See what permission does he have.

ASR 671 Reputation points

2021-11-11T08:09:19.117+00:00

Hi @MichaelHan-MSFT

So, I visited Site collection -> Click on site setting -> Click on Site Premission -> There I already added User 2 with Full Control.
User2 is a part of Site Collection Owner group as well.

But the awkward thing is User1 is given to me at a very initial stage. Now with user2, I created Multiple Web Applications and Multiple Sites, etc. But I don't face any issue with User1. I don't make User1 admin while creating site collections but he has access to all. What kind of magical power does this user have.

Just to make things more clear, I have a web service and I configure these users in Application Pool, and in code I use RunWithElevatedPrivileges.

Now I created New web application by logging in to Central Admin from User2. Created new site collection with this web application and provide User2 as administrator. And when I am traversing by setting app pool identity to User2 it is still giving error. But with user1 it is working fine.

So there must be some other privileges require to get Usage.Storage and traverse whole web application. And also User2 is also a part of farm administrator group. Amazing :). Just to confirm I haven't done any mistake let me include steps which I perform.
I go to central admin -> click on security->Manage the farm Administrators Group -> And added user2 in this group.

I want every possible right for this user. Just like user1. But not sure how to do that.
Its SharePoint 2013

ASR 671 Reputation points

2021-11-11T08:54:31.393+00:00

One more thing, Whenever I create a new web application via any user. User1 always has dbowner user mapping database. Now sure how. But when I give similar privileges manually to user2, issue still persist.

MichaelHan-MSFT 18,016 Reputation points

2021-11-11T09:25:34.853+00:00

Looks like user1 is SharePoint Farm Service account.

ASR 671 Reputation points

2021-11-11T10:17:42.817+00:00

Yes, I checked and it is farm service account.
But it only allowed one farm service account. How can I give similar permission to user2 as well.

MichaelHan-MSFT 18,016 Reputation points

2021-11-12T10:14:13+00:00

Just did a test, if I give permission to user on the web application(I give full control) , the user will automatically have permissions to all the site collections under this web application

When i check, it would like this:

ASR 671 Reputation points

2021-11-15T07:00:23.493+00:00

@MichaelHan-MSFT
Okay, to check this. I go to Site collection URL via browser. Then I clicked on Site Setting. Then Site Permission within User and Permissions. Then Check Permission and then I specify user name. Looks like user have all the required permissoin. PFA, snapshot.

MichaelHan-MSFT 18,016 Reputation points

2021-11-16T03:03:41.967+00:00

If the user2 has enough permission, it should work.

When you change app pool identity to User2, please make sure that: 1. user2 is a managed account. 2. run iisrest after the change.

ASR 671 Reputation points

2021-12-02T05:10:46.487+00:00

Hi @MichaelHan-MSFT ,
Could you please provide the steps on how to check if user is managed account or not?

Wendy Li_MSFT 1,711 Reputation points Microsoft Vendor

2021-12-03T01:42:31.783+00:00

@ASR To check if a user is managed account or not, you can refer to the followings:

Go to Central Administration.

Click Security and then select Configure Managed Accounts.

The list of existing managed accounts is displayed.

--------------------

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Wendy Li_MSFT 1,711 Reputation points Microsoft Vendor

2021-12-06T02:28:20.677+00:00

@ASR Have you tried the above suggestion? Do you have any further questions about this thread?

ASR 671 Reputation points

2021-12-06T04:27:21.213+00:00

Hi @Wendy Li_MSFT , @MichaelHan-MSFT

Yes, it is part of Managed Account. Not sure what is going wrong. Application only working when I associate this user with Farm Server Account, steps I already provided.

Wendy Li_MSFT 1,711 Reputation points Microsoft Vendor

2021-12-06T07:22:24.397+00:00

@ASR Thanks for your feedback. I updated the original answer to make sure the suggestion is clear.
In the community, we are focusing on break-fix, if you want to know the root cause of this issue, we suggest you open a ticket from Microsoft to analyze this issue further.

Besides, if you have no further questions about this thread, please remember to accept the answer that helps you to close this thread, Thanks for your understanding.
Sign in to comment
sadomovalex 3,626 Reputation points

2021-11-16T15:23:37.737+00:00
how exactly do you run provided code? Is it running with Sharepoint context (e.g. as SP web service or application layout page opened in context of some SP site like this http://example.com/\_layouts/15/MyPage.aspx) or you run it without SP context (e.g. as console application or SP job)?

If you run it with SP context then you need to modify your code like that: SPSecurity.RunWithElevatedPrivileges(() =>
{
using (var elevatedSite = new SPSite(webApplicationUrl))
{
var webApplication = elevatedSite.WebApplication;
foreach (SPSite sps in webApplication.Sites)
{
string size = FormatSize(sps.Usage.Storage);
}
}
});

I.e. it is necessary to reopen SPSite under RunWithElevatedPrivileges - otherwise RunWithElevatedPrivileges won't have effect. After that code will run under SHAREPOINT\System account (=account of app pool used by Sharepoint web site in IIS) which should have access to sps.Usage.Storage.

If you run this code without SP context - then you don't need RunWithElevatedPrivileges since it has effect only when SP context presents. In this case code is always running under account of user which ran the code. If it fails and you already added Full control policy for this user on this web application, try to add this user to Site collection administrators of each site collection in web app including root site collection (go to Site settings > Site collection administrators > Add user under which you run this code. Repeat this step for all site collections in web app)
Please sign in to rate this answer.
ASR 671 Reputation points

2021-11-18T17:52:41.92+00:00

Hi @sadomovalex
Below is my code and I am also following the same approach. When I select this user as a farm service account everything works as expected. Otherwise it is throwing error. Farm Service Account is a big thing. It would be good if we can achieve this with limited privileges.

SPSecurity.RunWithElevatedPrivileges(delegate ()
{
SPWebApplication webApplication = SPWebApplication.Lookup(new Uri(webApplicationUrl));
foreach (SPSite sps in webApplication.Sites)
{
if (sps != null)
{
size = FormatSize(sps.Usage.Storage)

} } });
Sign in to comment