I'm running into an issue with some site collections in a SharePoint 2010 web application. After migrating to claims, there are a couple site collections that give Access Denied, even to users that have been set as site collection administrators or given full control through central admin user policy.

Our default zone is running NTLM and the web app has been extended to add one that supports both NTLM and Forms-based authentication. Users can log in find using both NTLM and forms.

I've tried re-running MigrateUsers on the web application and verified that users have been converted to their claims ids.

Users have no problem logging in and accessing other site collections, but these sites consistently give Access Denied, no matter which user attempts to access them.

2 Answers 2


Have you verified that the portalsuperuseraccount and portalsuperreaderaccount properties of the web application are set to Claims-based account names? If they were set before the migration, they may still exist in a non-Claims encoded format.

You can update these values through PowerShell:

$wa.Properties["portalsuperuseraccount"] = "i:0#.w|domain\apppool"
$wa.Properties["portalsuperreaderaccount"] = "i:0#.w|domain\apppool"
  • I found that it was indeed related to the object cache, however the usernames were set to claims-based. The users also had proper access policy. I set the accounts back to the default, which seemed to disable the object cache for now (though I do get event log items complaining about the accounts not being configured) and everything is back to working properly.
    – markt
    Commented Jun 16, 2011 at 0:02
  • @markt: If Danny's answer solved your problem, you should mark it as the correct answer. :)
    – Kit Menke
    Commented Aug 14, 2011 at 17:31
  • @kit - it didn't solve my problem, and so I have not marked any answer as correct yet. ideally I would like the object cache to work.
    – markt
    Commented Aug 19, 2011 at 23:34

Also, do these site collection access data / lists from other site collections that don't have Claims enabled? if 1 webpart throws an access denied on your homepage for instance, the entire page will be inaccessible. Can they access the _layouts/viewlsts.aspx page?

P.S., the Search App probably needs to have Claims enabled as well:

$searchapp = Get-SPEnterpriseSearchServiceApplication

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.