SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have the following script that was running on sharepoint 2010 where we had clasic windows authentication.

When we moved to SP 2013, the authentication was changed to Claims.

The following code doesnt work anymore on Sp 2013

$spsite = new-object Microsoft.SharePoint.SPSite("");
$web = $spsite.openweb("/subsite1/subsite2/")
$removeUser = $web.AllUsers["domainname\username"];

I have to add the claims thing to make it work

$spsite = new-object Microsoft.SharePoint.SPSite("");
$web = $spsite.openweb("/subsite1/subsite2/")
$removeUser = $web.AllUsers["i:0#.w|domainname\username"];

How can I change this to make it work without the claim thingy!

share|improve this question
You may want to use the SiteUsers collection rather than the AllUsers collection depending on the requirements. SiteUsers has the largest set of principals. – RJ Cuthbertson Mar 3 '14 at 15:47
up vote 6 down vote accepted

Try this variant, replacing the AllUsers lookup with EnsureUser

$spsite = new-object Microsoft.SharePoint.SPSite("")
$web = $spsite.openweb("/subsite1/subsite2/")
$removeUser = $web.EnsureUser("domainname\username")

Or, if you do not wish to add the user to the site even to then delete him/ her, you can build on this functionality (could probably be improved a great bit):

$loginName = "domainname\username"
$users = Get-SPUser -Web $web.Url

foreach($user in $users)
         $removeUser = $user

Or, as this guy has done, implement a supporting method:

$m = [Microsoft.SharePoint.Administration.Claims.SPClaimProviderManager]::Local
Add-PSSnapin Microsoft.SharePoint.PowerShell -ea silentlycontinue 
Function Get-SPClaim {
    param ([string]$user)
    $claim = New-SPClaimsPrincipal -identity $user -IdentityType "WindowsSamAccountName"
    return $m.EncodeClaim($claim)

that you can use like:

$userWithClaim = get-SPClaim($loginName)
$removeUser = $web.AllUsers[$userWithClaim]
share|improve this answer
as far as I know ensureuser will add the user if it doesnt exist and I dont want that, I just want to know if the user exists or not to remove it later in the script. – Esteban V Mar 3 '14 at 14:49
Yupp it will, but it is also one of your easiest way to get a reference to the user. If you do not want to add the user you can see my update – Robert Lindgren Mar 3 '14 at 14:53
Booo, I found the same thing but didn't see your update x). – Cameron Verhelst Mar 3 '14 at 15:22
@CameronVerhelst Haha, sometimes you need to be fast and furious! – Robert Lindgren Mar 3 '14 at 15:26
When it concerns StackExchange reputation, definitely ;) – Cameron Verhelst Mar 3 '14 at 15:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.