Users with Full Control permission are not able to create sub-site in SharePoint

Problem Statement:

I spent lot of time to fix a strange issue while working with SharePoint 2013 project. Issue was a user having Full Control permission in SharePoint Top level site was not able to create a sub-site. Each time user tried to create either a "Project Site" or "Team Site" user got “Sorry, you don’t have access to this page” or “Access Denied” error. This was the identical behavior for all the users having Full Control permission.

Problem Symptoms:

      1. It appeared SharePoint was ignoring the Full Control access permission.

      2. User with site collection administrator permissions could create sub-sites.

      3. New site collections on the same web application operated normally without this issue.

Root Cause:

     1. Internally, SharePoint manages a hidden list named "TaxonomyHiddenList". URL of the list is -  "[sitecollectionURL]/lists/taxonomyhiddenlist".

     2. Generally, All authenticated users (everyone) has Read access to this list.

     3. As a site collection administrator user, when I checked permissions of the list, I found none of user or group were having permissions to this list as you can see in below screenshot.

Resolution: The solution was simple once identified. We should assign read access to all authenticated users (Everyone) operating within the site collection.

I had spent more time to fix the issue as it was a difficult one to identify, Hope this helps you out to overcome it more efficiently.

If you have any questions you can reach out our SharePoint Consulting team here.

Nintex Workflow: Access denied. You do not have permission to perform this action or access this resource.

Working with Nintex workflow, I was trying to send an email through "Send Email" action to users within SharePoint Group. If user through which workflow is kicked off, is part of that SharePoint Group then workflow/email works fine. But If user is not added in that group, getting below error: (Even that user has full control permission on site.)

"Access denied. You do not have permission to perform this action or access this resource."

Cause:

Basically, when "Send Email" action executes, Nintex try to get users information to whom email needs to be sent out. If logged in user is added in the SharePoint group, Nintex is able to retrieve the information. But if user is not part of the group, it won't be able to access member information of the group.

Resolution:

To overcome this situation, Allow everyone to see the members of the SharePoint group. To make this change, follow below steps:

Note: This will enable other users who are not part of the group to view all  members of  the group.

• Go Site Settings --> People & Groups, browse to that SharePoint Group.

• From settings menu, select Group Settings.

• Update Group settings --> view permission to "Everyone".

• Click OK.

If you have any questions you can reach out our SharePoint Consulting team here.