Access Denied When Accessing Search Service Application With Search Server Express 2010

Search Server Express is an excellent alternative to straight up SharePoint Foundation. It’s also free, but it gives you the fundamental underpinnings of the full SharePoint search infrastructure, plus a few other goodies. I’ve written about this previously here and here.

If you follow best practices for SharePoint deployment, and use a separate account for installing the bits and for the Farm account, you may run into a very odd little error. After everything is set up and you try to access the search administration application, you receive an access denied error. This happens even though the account that you’re logged in as is a Farm administrator, and a site collection administrator for the Central Administration site collection. If you log in as the farm account, all is well, but the actual administrator account is denied access.

To the best of my knowledge, this happens because of some oddness related to claims authentication. SharePoint properly applies the rights of the farm account, but not the setup account.

The fix for this is to properly add the NTLM authentication account for the required user into the User Policy for the Central Administration application. Unfortunately, unlike all other applications, you cannot change the User Policy for the Central Administration application through Central Administration itself.

You can, as with many other things however, do this through PowerShell.

I have shamelessly lifted the PowerShell script below from Tore Kristiansen at the Code Project.

[void][System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint")
$site = new-Object Microsoft.SharePoint.SPSite("http://SitesCBA.domain.no")
$wa = $site.WebApplication
$user = "domainuser"
$policy = $wa.Policies.Add($user, $user)
$policy.PolicyRoleBindings.Add($wa.PolicyRoles.GetSpecialRole(
[Microsoft.SharePoint.Administration.SPPolicyRoleType]::FullControl))
$wa.Update() 
$site.Dispose()
 

In the above script, replace “SitesCBA.domain.no” with the URL of your Central Administration site, and “domainuser” with your setup user account (or any other). After using this script, your service applications should become available.