Users getting access denied when trying to create a security group

Hello,
I created an MPR for granting right through an approval workflow for joining security group, but getting the following error. Any thoughts what could be going wrong?
Error processing your request: The operation was rejected because of access control policies.
Reason: The operation failed as a result of insufficient access rights.
Attributes: ExplicitMember
Correlation Id: edc226e9-ecb9-42c2-ab20-4fa8b5643056
Request Id:
Details: No policy grants the Requestor permission to complete all changes.
This is what I see in the even log:
Requestor: urn:uuid:9373552a-c063-4fb9-abcd-3501d151a061
Correlation Identifier: edc226e9-ecb9-42c2-ab20-4fa8b5643056
Microsoft.ResourceManagement.Service: Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: ManagementPolicyRule ---> System.Data.SqlClient.SqlException: Reraised Error 50000, Level 16, State 1, Procedure DoEvaluateRequestInner,
Line 1319, Message: Permission denied: <ai><Name>ExplicitMember</Name></ai>
   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
   at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
   at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
   at System.Data.SqlClient.SqlDataReader.ConsumeMetaData()
   at System.Data.SqlClient.SqlDataReader.get_MetaData()
   at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
   at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)
   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)
   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)
   at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method)
   at System.Data.SqlClient.SqlCommand.ExecuteReader()
   at Microsoft.ResourceManagement.Data.DataAccess.DoRequestCreation(RequestType request, Guid cause, Guid requestMarker, Boolean doEvaluation, Int16 serviceId, Int16 servicePartitionId)
   --- End of inner exception stack trace ---
   at Microsoft.ResourceManagement.WebServices.RequestDispatcher.CreateRequest(UniqueIdentifier requestor, UniqueIdentifier targetIdentifier, OperationType operation, String businessJustification, List`1 requestParameters, CultureInfo locale, Boolean
isChildRequest, Guid cause, Boolean doEvaluation, Nullable`1 serviceId, Nullable`1 servicePartitionId, UniqueId messageIdentifier, UniqueIdentifier requestContextIdentifier, Boolean maintenanceMode)
   at Microsoft.ResourceManagement.WebServices.ResourceManagementService.Put(Message request)
Thanks,
John

Hi,
You probably missing another MPR to give the right (checkbox "Grants permission") to Add and Remove value for attribute "Explicit member". Set an authorization workflow is not enough!
Regards,
Sylvain

Similar Messages

  • Oracle Apex export application getting access denied when trying to download

    DB: 11.2.0.3
    Apex: 4.2.2.00.11
    Apex Listener: 2.0.3.221.10.13
    WLS: 10.3.6.0
    Chrome: Version 29.0.1547.76 m
    and IE 10.0.9200.16660
    I'm the admin of the workspace that has one application. Made a change to the application and went to export the application so I can source control it.
    Followed the Export wizard while in the application, hit the Export/Import button and clicked Export. Changed the File Format to "Database", Export Supporting Object Definitions to "No" and left everything else as default. Clicked the Export Application button and get "Application 108 exported" success maessage. Navigate to the Manage Export Repository and I see the exported application labled "f108.sql and I click on it and I get "Access Denied".
    Whats the trick? What am I missing?
    If I change File Format to "Unix" or "DOS" the file automatically downloads.
    Thx,
    Russ

    Hmm I wonder if it has something to do with:
    bug #16760897
    http://www.oracle.com/technetwork/developer-tools/apex/application-express/apex-422-known-issues-1940409.html
    The bug description mentions ORA-06502, but get_file has a when others exception handler that simply returns "Access Denied".
    What do you folks think?

  • Getting access denied when trying to loging to sharepoint 2010 site collection.

    only Site Collection Administrators  are able to logging in to the site,other than that
    If i give any View or read or contribute permission to any user then he is not able to logging in to the site getting Access Denied ERROR.
    Below is the error generated in the LOG folder & attached here with screen shot.
    Request (GET:http://sharepoint-app:2525/_layouts/accessdenied.aspx?closeConnection=01
    vijay kumar designer 2010

    Tanq it solved my problem Fadi
    Abdulwahab
    vijay kumar designer 2010

  • Why do i get access denied when trying to download CS6 Design & Web Premium?

    I have a serial number for CS6 Design & Web Premium. I have a new computer I want to set it up on. I went to download it from Download CS6 products but I keep getting:
    Access Denied
    You don't have permission to access "http://trials2.adobe.com/AdobeProducts/DSST/CS6/win32/DesignWebPremium_CS6_LS16.7z" on this server.
    Reference #18.d1e1a60.1425598287.217a0f4
    Does anyone know what I'm doing wrong?
    Thanks for any help,
    Noah

    Make sure you have cookies enabled and clear your cache.  If it continues to fail try using a different browser.

  • Why do my Visitors users get Access Denied in my New Forms - Mobile Devices Only

    The issue I have is that I have a SP2013 Site with a group Visitors.
    the default Site Permissions have been set to Read.
    I then created a SharePoint List with a People Picker.
    I broke the Security inheritance and gave the Visitors group Contribute Permissions
    In Browser mode, they can access the site, open all links and even add content to list.
    When I do the same actions on a mobile device, All the visitors get Access Denied when clicking on the Add Content Link.
    The Link I make available is "https://myweb/sites/site/Lists/mylist/NewForm.aspx"
    I have found some suggestions about unplublished content, but this does not explain why the user can perform the required actions on a desktop, but not on a mobile device using the same link

    Hi,
    By mobile do you happen to mean iPhone? There has been quite a few issues with SharePoint 2013 and iOS authentication. You might want to refer to the following exchange.
    http://apple.stackexchange.com/questions/146808/ios-8-safari-sharepoint-2013-windows-authentication-support
    Eric Overfield - PixelMill -
    ericoverfield.com -
    @EricOverfield

  • I receive "Database access denied" when trying to add component 4543BD

    I receive "Database access denied" when trying to add component 4543BD to my schematic. This component was added from a previous version. I'm using Multisim version 12.0.0  Student edition.
    Solved!
    Go to Solution.

    Hi Diarra,
    I checked my database and  the  4543 is not in the Student Edition. If you opened a schematic that was created in a higher version such as the Educaiton Edition and copied the part to your database, when you place this part you will get the access denied message. 
    Attached is a schematic with the part, you can open it and build you circuit around it.
    Tien P.
    National Instruments
    Attachments:
    4543.ms12 ‏62 KB

  • Photoshop cs4 access denied when trying to install from disc in Windows 7 64bit.

    Photoshop cs4 access denied when trying to install from disc in Windows 7 64bit. I tried it in
    safe mode and it starts to install but get an error there as well.
    What do I do?

    So when you put the disk in it won't run correctly? When the disk is inserted you should have a window pop up with 2 options. 1 to install and the other to see what is on the disk. Choose to explore or open the disk. Go to the CS4 folder where the photoshop .exe file is (that will run the setup), right click on the .exe file and choose run as Admin and it should start. See if it will install. If not then read below.
    I am not sure how far you got in the install before so chances are you will have to run the CS4 cleanup utility. 2 levels to run at but don't use 1 or 2 just type in the number 3.
    http://www.adobe.com/support/contact/cs4clean.html
    You may need to run the windows installer cleanup utility too
    http://support.microsoft.com/kb/290301
    Before you try to reinstall the software ensure that adobe reader is not installed. If it is remove it. It has caused issues in the past with vista and CS4 installs.
    Also turn off windows Defender and any anti-virus software. You can keep UAC on in Windows 7.
    During the CS4 install at 90 percent it will almost stop and may take 5 to 10 mins to finish. This is normal. What a pain huh......
    After install is finished, reboot
    After reboot, go to the CS4 64 bit or 32 bit icon (depends on 32 or 64 bit Windows 7) in start area, right click on CS4 64 bit (if you have windows 7 64 bit) and choose properties, compatibility tab and then check run as Admin at the bottom area. Hit apply, ok to close out.
    Now start CS4 and run the updater.

  • I get access denied when I try to search on your site.

    Please help me. I get access denied when I try to search on your site. I have emptied cache. I tried Safe Mode the way you suggested. Still access denied (though my printer then would not respond to me and I spent $85 to have my It consultant fix that problem.

    Hi,
    You've opened 3 different threads for the same issue. Please only open '''ONE''' thread per support request.
    Continue here [https://support.mozilla.org/en-US/questions/995124?esab=a&s=&r=3&as=s /questions/995124]
    Closing thread

  • I get access denied when I add a page to a workset in EP 7

    I get access denied when I add a page to a workset in EP 7.
    Please advice.

    Hello,
    This seems to be a permission issue. Assign the user id proper permission, say system_admin_role and then try.
    Regards
    Deb

  • I get this error when trying to create a ringtone - iTunes could not connec

    I get this error when trying to create a ringtone:
    "iTunes could not connect to the iTunes Store - an unknown error occurred (11556)"
    But I CAN connect - if I click on the iTunes Store, it connects right away.
    I want to make a ringtone from a song that I purchased, but all I get is the same error message.
    iTunes 9.2.2, Ireland iTunes Store.

    have you seen this KB article: http://support.apple.com/kb/HT1398 ?
    JGG

  • Get "Access Denied" when click open a PDF file

    Hi Friends,
    Get "Access Denied" when click open a PDF file linked from SharePoint 2013 page.
    What are the route causes any one is remove the permissions are stopped the inheritance permissions of the library.
    Can anyone face the same issue please help me.
    Thanks,
    Tiru
    tirupal

    Hi,
    If you are able to open the same document earlier,then  anonymous access enabled on your doc library then.
    If you are facing this problem in first time,then you do not have required permission (may be custom permission level has been set ) on it.
    Murugesa Pandian.,MCTS|App.Development|Configure

  • ACCESS DENIED when trying to use custom site template to create new Subsite

    I am trying to create a new site using a custom template. I am the new admin here at the company. Other also are having "access denied" errors when trying to create the site using these custom templates. 
    However I can still create a site using the out of the box templates. I have given myself site collection admin (primary) and I am a farm administrator as well. Any ideas on why I keep getting access denied to specific templates?
    The entire site collection is using the custom template. When I try to create a new site under the site collection with a custom template now, it says "access denied". Any ideas?
    Thanks!
    Note - I am able to use the Custom Site Templates in the test environment without any issues. Only in the production/live environment am I getting the access denied error.

    I am not finding anything that comes up in the ULS logs about the access denied. I tried creating the site in the test environment using the custom template and it worked. I go to the production environment and try to create the site with the same template
    and get "error:access denied - current user domain\user" I checked in the ULS logs as soon as the access denied appears (pretty quickly after pressing create) and there is nothing at that specific time. This is a huge problem, is there any way to
    work around or fix this? I'm a new admin.

  • Access denied when trying to use PDF printer as normal user

    I have Acrobat 8 professional installed on a computer running Windows XP SP3. When i try to print a document to pdf from any program as Administrator it performs just fine. When i log on as a normal, restricted, user i get the window popup asking for a file name and location and whereever i try to save a file i get "access denied" error.
    Users have right to write and modify in all of the folders i've tried to save to (desktop, my documents, custom made folders), but i think the problem is with the temp file being written to some system folder where restricted users don't have permission to write. Did anyone encounter a similar problem, and how did you solve it? What directories do the normal users need access to in order to perform printing.
    Thank You

    The forum added some nice links and i found my answer here http://forums.adobe.com/message/1179199#1179199 - changed the registry key permissions and it's working like a charm. Thank you.

  • Access Denied when trying to open a file that is encrypted on network share with EFS

    I just recently enabled EFS on the default domain policy and created a new network share, encrypted a file and added myself to that file and tried to open the file from my workstation.  I then receive an error "Access denied", I also tried
    to create a file and encrypt it on that same share and get an error "The requested operation cannot be completed.  The computer must be trusted for delegation and the current user account must be configured to allow delegation."  
    My steps.
    1. Enable group policy for EFS, removed the expired certificate that was already there and Created a new Data recovery agent.
    2. Created a network share, created a test file, enabled encryption on the file 
    3. certmgr.msc, personal and requested a new certificate, Basic EFS
    4. On the network share and properties of file, advanced, details and added the user
    5. from the workstation tried to access the file, Access Denied.  I can create any file I won't just can't add attributes to encrypt the file or open an encrypted file
    Now if I go to the server where the CA is located which is also the AD server and create share and run the same process it works as expected.  I'm guessing I have to export the cert from the CA server as a pfx and import that to both the server that
    has the network share and the workstation but that still doesn't seem to work.  Maybe I don't understand how EFS works and this is not possible?  Any suggestions would be appreciated.

    You are correct in not understanding how EFS works.
    When you connect to an encrypted file via a network share, the encryption/decryption takes place *on* the server. To enable over the network access, the server's computer account must be trusted for delegation.
    The server actually impersonates the user and creates a user profile on the server (containing the defined EFS certificate and private key). The important thing to remember is that the files is transmitted in clear text from the server to the client.
    See http://blogs.technet.com/b/instan/archive/2010/08/11/remote-efs-decryption-and-trusted-for-delegation-requirements.aspx
    Brian

  • Access Denied when trying to access shared folders on the server with administrative privileges

    I have problem accessing shared folder on the server machine from Windows 7 machine even if I try to access it with administrative privileges (server Administrator account). I will try now to explain better my situation.
    In my company, we have small network infrastructure with one main server machine (HP ProLiant server) with Windows Server 2012 R2 installed and couple of desktop machines. The network is administrated by me.
    On Windows Server we have installed and setup DHCP, DNS, Remote Access and Routing, File and Storage and Active Directory services. Desktop machines are having Windows 8.1 Pro, Windows 8.1 or Windows 7 Home Premium installed on them. In Active
    Directory I have created domain, User groups and Users for employees in my company and so far, I didn't added desktop machines to the domain.
    Also, I've created one folder on the server which should contain different projects data for network users and I have set access permissions and security for this folder and shared it on the network (I've added couple of users to one user group and I
    gave Full control to this group over this folder). When I try to access this folder from network, I've been asked for login credentials (normally), where I just type in one of users username and password who has been given access permissions to (who is member
    of group with full control over the folder). From Windows 8.1 Pro and Windows 8.1 machines I can access and work on this folder without any problems.
    The problem comes with Windows 7 machines. On Windows 7 machines (I have also tried this with Windows 7 Ultimate in VMWare) I can access server, I can see its shares, but as soon I try to access folder I've created for projects, I get Access Denied message
    with request for User login credentials. Whichever user account I use (even servers main Administrator account) I keep getting this message over and over and I'm unable to access it at all.
    I have also tried to access the server through VPN (from local or outside) but I'm getting the same error again. Also I've tried to add these Windows 7 machines to the domain and login with domain user but the result is the same. Turned off both firewalls
    (on server and desktop machines, which I know is unnecessary, but lets try it), still same case. I've tried couple more things with registry editor on desktop machines which I found on different forums and websites but still no luck. And now I don't know
    what else I can do.
    Does anyone knows what's the problem here, have I set something wrong, have not set something I should?

    Hi MeipoXu,
    thanks for your response. I will first answer on your question.
    Yes, the main issue is that we can see the folder when we access the server but we cannot access its contents from Windows 7 machines. I have tried on two machines, one with Windows 7 Home Premium version and the other one with Windows 7 Ultimate version
    and the situation is the same.
    As you recommended, I've checked Network Discovery and File and Printer Sharing and the situation is next: File and Printer Sharing is turned on all layers (Private, Public and Domain) while Network Discovery is off for all layers too. I don't know if this
    is normal thing but Network Discovery cannot be turned on in Windows Server (I'm able to select Turn on Network Discovery and apply the changes, but when I get back to this settings page, I again see that it's turned off, so I assume this can't be changed
    at all).
    I also tried with icacls in command prompt and everything seems to be ok there regarding permissions. Share permissions are set to Full control to Everyone and Security permissions are set to Full control only for Administrators and the user group I've created
    for employees in my company. The confirmation for this is that on Windows 8 machines you can access this folder without any problem and without getting any message connected with access permissions with any user account within this user group. This share is
    created through File and Storage Services service in Server Manager panel.
    And then something came up on my mind. I went in Server Manager to check shared folder settings in File and Storage Services and under Settings page I saw that "Encrypt data access" has been enabled (I enabled this option because I thought
    I will get more security with this option). I asked my self what would happen if I disable it, tried it and now everything works ok on Windows 7 machines too. Now I assume that Windows 7 doesn't have this feature implemented or there are some
    settings which needs to be set on Windows 7 machines to make this encryption thing work with Windows Server. So basically, I will let this feature off for now until I find out more about it and how to implement it to work with all operating systems.
    I want to thank you once more for your kind help!

Maybe you are looking for