5

I successfully migrated my web app from SP2010 to SP2013 without error or warnings

enter image description here

enter image description here

But when I tried to access the migrated site, it gives me an Access Denied Error

I already do this from my SP2010 environment (before proceeding to backing up the content database)

$WebAppName = "http://<yourWebAppUrl>"
$wa = get-SPWebApplication $WebAppName
$wa.UseClaimsAuthentication = $true
$wa.Update()

$account = "yourDomain\yourUser"
$account = (New-SPClaimsPrincipal -identity $account -identitytype 1).ToEncodedString()
$wa = get-SPWebApplication $WebAppName
$zp = $wa.ZonePolicies("Default")
$p = $zp.Add($account,"PSPolicy")
$fc=$wa.PolicyRoles.GetSpecialRole("FullControl")
$p.PolicyRoleBindings.Add($fc)
$wa.Update()

$wa.MigrateUsers($true)

$wa.ProvisionGlobally()

I get this error, I am using the administrator account and yet getting an access denied error

enter image description here

1
  • Can you access the site using the API i.e. Get-SPWeb? If yes try accessing the settings page _layouts/15/settings.aspx
    – Bunzab
    Feb 3, 2015 at 13:20

1 Answer 1

3

By default when we create a web application in SharePoint 2013, it gets created with Claims authentication. When we migrate the content DB to 2013, it recognizes the user account only in this format i:0#.w|domain\username . Though it’s an AD account it no more recognizes the Domain\UserName format.

SharePoint assumes all users to be claim users and renders them so. Therefore, a normal windows user – “Domain\UserName” appears as “i:0#.w|Domain\UserName”. Moreover, it uses the username in this same format to check for its permissions but does not find a matching entry for the user as the database has windows users – “Domain\UserName”. So, the site will give you an access denied.

Note that the System Account will work since its “Domain\UserName” is never used and System Account is a keyword used by SharePoint for the application pool identity. Therefore, it remains unaffected.

$webApp = Get-SPWebApplication -identity "http://serverURL"
$webApp.UseClaimsAuthentication = $true
$webApp.Update()

//convert user accounts to claim format

$webApp = Get-SPWebApplication -identity "http://serverURL"
$webApp.MigrateUsers($true)

then do iisreset

http://www.winwire.com/access-denied-error-after-migrating-to-sharepoint-2013/

Since you have done everything as mention above,you might want to check if the site is using claim authentication using the following script:

$web = Get-SPWebApplication "<URL for Application>" 
$web.UseClaimsAuthentication

If return false then you might need to re-run the script as shown above

If still not working try the following:

$webApp = Get-SPWebApplication http://webappurl
$webApp.Properties["portalsuperuseraccount"] = "<claimsId>
$webApp.Properties["portalsuperreaderaccount"] = <claimsId>
$webapp.Update()

If still not working, then it worth to configure object cache at Web application level:

Configure object cache settings

  • Verify that you have the following administrative credentials: You must be a member of the Administrators group on the local computer to configure the object cache settings.
  • Click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
  • In Internet Information Services (IIS) Manager, in the Connections pane, click the plus sign (+) next to the server name that contains the web application, and then click the plus sign next to Sites to view the web application or applications that have been created.
  • Right-click the name of the web application for which you want to configure the disk-based cache, and then click Explore. Windows Explorer opens, with the directories for the selected web application listed.
  • Right-click web.config, and then click Open.
  • If the Windows dialog box appears, select Select a program from a list of installed programs, and then click OK.
  • In the Open With dialog box, click Notepad, and then click OK.
  • In the Web.config Notepad file, find the following line:
  • To change the size of the cache, type a new number for maxSize. The size is expressed in megabytes (MB), and 100 MB is the default.
  • Save the Notepad file, and then close it.

link:https://technet.microsoft.com/en-us/library/cc770229(v=office.15).aspx#object

6
  • I can now access the site using this code in powershell: $WebApp = Get-SPWebApplication “WebAppURL” Convert-SPWebApplication -Identity $WebApp -To Claims –RetainPermissions -Verbose $WebApp.MigrateUsers($true) But when I try to access the site settings, it will give me again the "Access Denied Error"
    – Ruel Ong
    Feb 4, 2015 at 1:33
  • Done your suggestion above, but still getting the "Access Denied" error when I am trying to go to site settings
    – Ruel Ong
    Feb 4, 2015 at 2:18
  • Hi Ruel, I have update the post. Could you try the last script.Let me how it goes.thx
    – Supermode
    Feb 4, 2015 at 2:58
  • Still not working :(
    – Ruel Ong
    Feb 4, 2015 at 8:34
  • Try to configure object cache setting. Please refer to my update post above
    – Supermode
    Feb 4, 2015 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.