Trying to switch from an ADFS Trusted Identity Provider to Kerberos. In the user profile service, users appear to be different identities. Do I need to migrate every account using Move-SPUser? It seems like most other migrations go from Kerberos to a trusted identity provider not the other way around
In this case, yes you have to migrate all users from ADFS to windows claims. As sharepoint treat both as a separate ids.
You can also witness after switching the authentication, your user will get access denied. Now you have to run the move spuser to move them.
Convert-SPWebApplication -Identity "http://XXX:8001/" -To Claims -RetainPermissions
I use the above command to convert website XXX on port 8001 to Claims mode.
A good Microsoft reference is: https://blogs.msdn.microsoft.com/besidethepoint/2010/05/08/double-hop-authentication-why-ntlm-fails-and-kerberos-works/
Migrating from SAML to Windows Claims requires some slightly different steps. Microsoft has outlined it here: Migration of Windows claims authentication to SAML-based claims authentication in SharePoint Server 2013. Note that this article includes both processes (Windows -> SAML; SAML -> Windows).
You may also find this KB useful if you run into any issues with the conversion. The Convert-SPWebApplication command cannot convert from Windows claims to SAML in SharePoint Server 2013.