Reza Alirezaei’s Blog

SharePoint Administration Toolkit ships with a very handy tool that’s installed at web site level (SPWeb) named Check Effective Permissions. Essentially, this tool checks to see if a SPPrincipal object has got permissions to any objects within the current web site and all the sub sites that inherit from the current site. It also provides other permission related reports such as anonymous access level or other factors that effect the level of access for the given SPPrincipal object.

Sometimes when you use the tool, it throws the “Value does not fall within the expected range” exception on SPRoleAssignmentCollection.GetByPrincipalId(Int32 principalId) method call. See the stack trace below:

[Xml]

Value does not fall within the expected range; at Microsoft.SharePoint.SPRoleAssignmentCollection.GetByPrincipalId(Int32 principalId)
at Microsoft.SharePoint.SPRoleAssignmentCollection.GetAssignmentByPrincipal(SPPrincipal principalToFind)
at Microsoft.Office.Server.SecurityReport.SecurityReportAccountManager.CheckPermissions(Object contextObject, String username, AclUIMode aclType)
at Microsoft.Office.Server.SecurityReport.SecurityReportAccount.BtnCheck_Click(Object sender, EventArgs e)

….

[/Xml]

In our case, since the exception was only thrown for some SPPrincipal objects, I did a quick analysis and found out that if the SPPrincipal has no role assigned to it (see the figure below), it blows up the API call. I know this may sound kinda bizzare. Why do we need an SPPrincipal without having a role assgined to it? For a number of reasons. For example, you may need to create the groups in advance and assign the permissions later. Or, maybe the groups are auto-generated by an import process, but something has gone wrong when assigning the roles. As a result, some groups do not have roles assigned to them.

By the way, people have reported other similar issues on the bottom of this page.