SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are currently running SP2010 within a development environment in a different domain. What I have been able to accomplish now is to create a cross forest trust so that users within the live domain can login (assuming rights are granted) to the development side. What I would like to do is change all of the current user access and ownership from their development side login (DEV\User1) to the live side (LIVE\User1) but am not sure exactly how to accomplish iterating through the entire sharepoint site and modifying these permissions. Has anyone done this before? Thanks!

share|improve this question

I believe the only option is to do exactly that, iterate through the entire SharePoint site.

Here is a powershell script that I quickly rejigged to be more in-line with what you're looking to do. Hopefully it helps you, please do test it out on DEV first because it is untested, and will likely need modifications because I've never actually done what you're looking to do.

You give it a site, and it will recurse to the depths doing what it does. Provided that it works of course. Sorry I can't give you more, hope this is at least useful. The site recursion stuff works, but the username change stuff might not, hopefully some other ppl will provide insight into that.

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

$oldDomain = "oldDomainHere"
$newDomain = "newDomainHere"

# this function will recurse to the farthest depths of the site.
function RecurseWebPermFix() {

    Write-Output "Site: $($Site.Url)"

    foreach($user in $Site.Users)
        $newLogin = $user.UserLogin -replace $oldDomain, $newDomain
        $user.UserLogin = $newLogin
        Write-Output "changing $($user.UserLogin) -> $($newLogin)"

    if($SiteIdentity.Webs.Count -gt 0)
        foreach($subWeb in $SiteIdentity.Webs)
            RecurseWebPermFix -Site $subWeb

$siteColl = Get-SPSite "http://your.root.spsite/"
RecurseWebPermFix -Site $($siteColl.RootWeb)
share|improve this answer
Well the looping appears to be working correctly however the userlogin property is read only so that will not be working... – Brian Oct 8 '12 at 16:54
up vote 0 down vote accepted

My script to transfer ownership of any users, sharepoint groups, and AD Domain groups:

$site = get-spsite http://portal/
foreach ($web in $site.allwebs) {
$groupprefix = "NEW_DOMAIN\"
$userprefix = "NEW_DOMAIN\"
$users = get-spuser -web $web.url
foreach($user in $users)
    $a= @()
    $displayname = $user.DisplayName
    $userlogin = $user.UserLogin
    if((!$userlogin.Contains("administrator")) -and (!$userlogin.Contains("LOCAL SERVICE")) -and (!$userlogin.Contains("authenticated users")) -and (!$userlogin.Contains("ID-TokenIssuer")) -and (!$userlogin.Contains("system")) -and (!$userlogin.Contains($groupprefix)))
        Write-Host $userlogin
        $isgroup = $user.IsDomainGroup
        $username = ""
        if(!$isgroup) # for users
            $a = $userlogin.split("\")
            $username = $userprefix + $a[1]
            Move-SPUser $user -NewAlias $username -ignoresid -Confirm:$false
        elseif($isgroup) #for groups
           Write-Host "---------- OLD LOGIN -------"
           Write-Host $userlogin
           $a = $displayname.split("\")
           $username = $groupprefix + $a[1]
           stsadm -o migrategroup -oldlogin $displayname -newlogin $username
           $group = $site.RootWeb.SiteUsers[$userlogin]
           write-host $username
           Write-Host "------- EOL ----------"
           $group.Name = $username


Then to rename the groups after the STSADM migrate:

$site = New-Object -TypeName Microsoft.SharePoint.SPSite -ArgumentList <url>
$group = $site.RootWeb.SiteUsers["<domain\group>"]
$group.Name = "<updated group name>"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.