SharePoint 2010 - Access is Denied, and I'm Site Collection Owner!

Had an interesting one yesterday. I finally got around to clearing up those annoying warning messages about the Cache Super Reader account in my Windows Event Viewer logs on one of my servers. I used the stsadm command to set the property for both the Cache SuperReader and SuperUser accounts, good to go - or so I thought!

Came in the next morning to find the server still up, but no one able to access any site collections on the web application where I set those accounts! SharePoint came back with Access is Denied, even though it was all fine yesterday, and the users were set up as Site Collection Owner through Central Admin. The logs didn't show a whole lot, other than an issue with Kerberos and the Services account I'm using - odd.

Knowing the last thing I changed was that cache account, I double checked the values, ran the PowerShell script referenced in the very good article SharePointServerCachesPerformance.docx - highly recommended read! The issue for me turns out that those accounts weren't added correctly in the User Policy for the web application. I repeated this on a dev box this morning, and verified indeeed you have to make sure your User Policy settings are correct:

1. Open SharePoint Central Admin
2. Click on Application Management
3. Click Manage web applications under Web Applications
4. Select (single click) the web app having issues (or better yet do them all while you're here!)
5. Click on the User Policy icon in the ribbon
6. Click Add Users
7. Click Next to select the zone, go with the default All Zones
8. Enter in the account of your SuperReader user, and grant this account Full Read permissions, then click Finish.
9. Repeat this for the SuperUser user, but grant this user Full Control.
10. iisreset - and let those users log in!

Happy 2012!!