Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Recently I have a problem that new Active Directory users cannot log into Sharepoint.

All other functionality seems fine, but it appears to be failing to create new user accounts.

To me, it looks like the FIM service was never setup and working so it appeared to be validating users in a different way, but I am not sure how this used to be working.

The only change which has occured between new users being able to log in was a rebuild of the primary domain controller after it had a corrupted disk. This means that the primary domain controller has been changed to a new server, although I cannot see why this might cause an issue.

share|improve this question
    
Are the new users added to SP either directly or via AD groups? Did you recreate the AD instance on the PDC or was there a BDC in place? –  David Lozzi Apr 29 '13 at 13:28
    
I have 3 domain controllers, so I just did an emergency transfer of domain ownership onto one of the other DC's. New users are added to SP using an security group. –  boburob Apr 29 '13 at 14:10
    
FIM is mainly used for the User Profile Service, for sync'ing user profiles. Not required for log in. SharePoint connects directly with AD to validate the user. Can SharePoint server ping the domain name? ping the new PDC? –  David Lozzi Apr 29 '13 at 14:25
    
Yes it can, where is sharepoint setup to read AD? –  boburob Apr 29 '13 at 14:29
    
It's an auto-magical feature. It assumes the AD domain it's installed on. You can configure it to point to specific ADs or completely separate auth stores by using the web.config file. It may be a good idea and check out the web.config, ensure your domain is not configured specifically in there. –  David Lozzi Apr 29 '13 at 14:34

1 Answer 1

Ok, so it turns out the problem was with the auto-magical feature of reading domain information from the server.

When the previous PDC failed and the domain was transferred to another DC, it looks like the synchronization between the other DC's and the DC that sharepoint was installed on failed.

Force removing the DC from the domain, cleaning up the metadata, and rejoining it to the domain solved the issue.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.