Problem running Update-SPProfilePhotoStore

After doing a user profile migration (SharePoint 2007 to 2010), one of the post-migration steps is to update the user profile photos.  The PowerShell script to do that is:

Update-SPProfilePhotoStore –MySiteHostLocation <url to my site host>

When I ran this (logged in as my SharePoint admin account) I got the following error:

Update-SPProfilePhotoStore : Object reference not set to an instance of an object.

 

The ULS log spits out:

Exception occurred while connecting to WCF endpoint: System.ServiceModel.Security.SecurityAccessDeniedException: Access is denied.

 

According to TechNet, I should:

Verify that you meet the following minimum requirements: See Add-SPShellAdmin. You must also be a site collection administrator for the My Site host, and you must be a User Profile service application administrator with the Manage Profiles permission.

Well that was all set and I was still getting the error.

It seems the cmdlet  uses the WCF service ProfilePropertyService.svc, so I gave my admin account full control in the Sharing section of the UPS application.

This got me further, but now I’m getting access denied for the my site host database.

So I add my admin account to the database containing my site host as db_owner, then re-run the cmdlet.

Success!  All photos are being added to the my site host library User Photos.

To maintain least-privilege, I undo the changes I made above regarding changing account permissions in the service and the database.