AD accounts in Sharepoint 2010

Question

We got our Sharepoint synchronized with Active Directory account names. So, the authentication goes through AD.

The question is, how to see these account names in Sharepoint? How to manage it as from Sharepoint side?

To be specific, one user in our system has several account names. Somehow, while using the services, current user account jumps from one to another. Does someone had such experience? How and where to admin this? How system decides which account it should take?

Any comments will be appreciated. thanks

UPDATE: Thanks to All, but my problems is not resolved. Actually I've found recently that account change happens while jumping from subsite to root site, and vice-versa. The OK account happens on subsite. The NOT OK account happens on a root site. "Not OK" account is not present in AD at all.

In hidden list suggested here there's only one OK account. I can't figure out where does it take old account name and why it jumps.

Any ideas/suggestions?

Answer 1

depends on how your user profile service is setup.

look at your hidden user list. any time someone logs to the site for the first time its recorded on that list:

/_catalogs/users/simple.aspx

above would be used like so:

http://webapp.com/mysharepointsite/_catalogs/users/simple.aspx

look at the list for the offending user, so on my list I could possibly have two ali jafer users (friendly name).

go into central admin and go to user profile service and look up for offending user.

go to active directory and search for offending user.

you need to compare all three to see what is going on. Is it the same account or separate accounts. Specifically on AD look at the samaccount and not the friendly name as that has to be unique.

check on sharepoint user profile service the accounts that have been imported and are upto date:

make sure AD is clean and the user once looked up is setup correctly with one account that they are signing in with or multiple accounts are correct. make sure that the friendly name is different within the AD group if possible else should sign in with the samaccount if possible.

an example of what I mean is:

friendly name: ali jafer

samaccount : ali-jafer

below image shows ad account, the logon name is usually the first and last name (friendly name or user principal name) and the samaccount is marked below.

I could have in theory multiple ali jafer users just like joe blogs or jon smiths but can only have one samaccount that is ali jafer or joe blogs or jon smiths. logging in with that account guarantees its that account that im logging in with.

next is to remove offending user from the hidden sharepoint list. This will not effect the user and will be added back in when he/she signs back into the site. next is to do a full sync on central admin on the user profile service....good to do this out of hours - just set the timer job to run after 1am is fine.... full sync should run once a week usually in the weekends and partial every night.

if for instance the user was to update the details on mysite and you want AD updated then that would need to be setup on central admin user profile service as an export per property look here for more info:

https://technet.microsoft.com/en-us/library/ff182925(v=office.14).aspx#mappings

Answer 2

We have users with multiple accounts in a multi-domain AD. While I have never seen SharePoint bounce from one account to another, I have had users log in from different accounts (unknowingly) and receive a different experience. The solution to this is to either consolidate the user into one account (in AD) or to add every instance of a user's account when you manage permissions in SharePoint. Then, if they switch, they have the same access.

I occasionally have users that are copied from one domain to another and their sID history is left intact. When that happens, only one account is visible in people picker. The solution here is to remove sID history from all duplicates. I can see this in ADSI Edit.

Answer 3

for AD users, use the user profile service in SharePoint. Other option is to create SharePoint groups and specify the users in that group. so that you will have specific information about which user account can do what.