0

I’m a new SharePoint administrator, and I’m trying to make a test SharePoint system for the first time. I’ve installed SharePoint (2013) and attached databases which were created by restoring a copy of the live SharePoint system. Everything looks right, but there’s a problem with the permissions.

Originally, I could only view SharePoint sites from the Farm account. The Site Collection permissions and the site permissions were all copied to the new system, but none of them work. I found a similar issue here: User permissions broken after Restore-SPSite

The solution provided was to remove and re-add the accounts. Removing and re-adding accounts with the same name does fix the issue.
So now I have a couple of sites that work because I was playing with removing and reading permissions.

That said, here are my questions:

  • Why might this have happened
  • Can I do something different so I don’t have an issue next time I try and make a test server
  • And is there any way to easily fix my system? ** My best idea was to write a powershell script that looks at the user name of every site and subsite, delete the name of every user and put it back in, but powershell skills are not savvy enough (yet)… and maybe there’s an easier way.

I would love ideas or suggestions. Thank you

0

Most probably this is because of the authentication method used in both farm are different. So when you remove the user and re add, it will added with proper claims or authentication type. That's why user able to access it.

Now you have to check what authentication being used in the live farm( claims, adfs, classic etc). then make sure same authentication configured in your test farm. then you will be all set.

here are couple of guidline for the migrating users which will help you

After migrating my web application from SP2010 to SP2013, I get access denied error

SharePoint 2013: Migrate users from Windows to Claims Authentication

  • Well.... it does look to be an issue with a classic authentication being upgraded to Claims when it was attached. I'm still working on how to fix it... but I wanted to let you know that you put me on the right track. Thank you. – Michelle.S Dec 19 '16 at 17:52
  • I am happy for this, check the last link in my reply...it will be easy fix for u. – Waqas Sarwar MVP Dec 19 '16 at 17:53
  • The function looks like it's working for user accounts, but it runs into issues when it runs into active directory groups. It skips them - but because the – Michelle.S Dec 19 '16 at 18:58
  • Oops... I hit enter... Let's try this again... The function looks like it's working for user accounts, but it runs into issues when it runs into active directory groups. It skips them - so sites where everyone should have access are still an issue. I'm researching how to add AD groups now - but any advice would be welcome. – Michelle.S Dec 19 '16 at 19:03
  • Darn it.... I was able to track down someone with permissions explicitly listed and not just in an AD group... and even though the code ran successfully, it doesn't look like it actually fixed the issue. But I'm close. When I get it, I'll post my code. – Michelle.S Dec 19 '16 at 19:12
0

Solution found... kind of.
Inspired by https://gallery.technet.microsoft.com/office/SharePoint-2013-Migrate-bbf4ae4d

This fixes the issue for most accounts, but runs into problems with group accounts and accounts without an email address. I'd say I'm 85% of the way there. I'm going to keep looking. Here's the code I have so far. Hopefully it will help anyone else who has the same issue.

function MigrateUsers($SiteCollUrl) 
{ 
    $site = Get-SPSite $SiteCollUrl 
    $web = $site.OpenWeb() 
    $groups = $web.sitegroups 
    $warning = 0

    foreach ($grp in $groups) { 
        write-host "Group: " + $grp.name -BackgroundColor Cyan -ForegroundColor DarkBlue  ;
        $groupName = $grp.name 
        foreach ($user in $grp.users) {
                "User: " + $user.name 
                    If(!$user.email)
                        {write-host "Skipping " $user.name -ForegroundColor Yellow
                        $warning = $warning + 1
                        write-host $warning " warnings"
                    }   
                    Else {
                        $userId = $user.email
                        $grp.RemoveUser($user); 
                        $user1 = $web.Site.RootWeb.EnsureUser($userId) 

                        $grp.AddUser($user1)          
                        write-host "User " $userId   " added to  " $groupName -foregroundcolor green 
                    }
        }  
    }  
    write-host "you have " $warning " accounts to manually fix" -BackgroundColor Red -ForegroundColor DarkBlue
}
  • To run... MigrateUsers -SiteCollUrl <your site collection> – Michelle.S Dec 29 '16 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.