I'm running into an issue with some site collections in a SharePoint 2010 web application. After migrating to claims, there are a couple site collections that give Access Denied, even to users that have been set as site collection administrators or given full control through central admin user policy.
Our default zone is running NTLM and the web app has been extended to add one that supports both NTLM and Forms-based authentication. Users can log in find using both NTLM and forms.
I've tried re-running MigrateUsers on the web application and verified that users have been converted to their claims ids.
Users have no problem logging in and accessing other site collections, but these sites consistently give Access Denied, no matter which user attempts to access them.