SharePoint permissions not working after restore from backup

Question

I’m a new SharePoint administrator, and I’m trying to make a test SharePoint system for the first time. I’ve installed SharePoint (2013) and attached databases which were created by restoring a copy of the live SharePoint system. Everything looks right, but there’s a problem with the permissions.

Originally, I could only view SharePoint sites from the Farm account. The Site Collection permissions and the site permissions were all copied to the new system, but none of them work. I found a similar issue here: User permissions broken after Restore-SPSite

The solution provided was to remove and re-add the accounts. Removing and re-adding accounts with the same name does fix the issue.
So now I have a couple of sites that work because I was playing with removing and reading permissions.

That said, here are my questions:

• Why might this have happened
• Can I do something different so I don’t have an issue next time I try and make a test server
• And is there any way to easily fix my system? ** My best idea was to write a powershell script that looks at the user name of every site and subsite, delete the name of every user and put it back in, but powershell skills are not savvy enough (yet)… and maybe there’s an easier way.

I would love ideas or suggestions. Thank you

Answer 1

Most probably this is because of the authentication method used in both farm are different. So when you remove the user and re add, it will added with proper claims or authentication type. That's why user able to access it.

Now you have to check what authentication being used in the live farm( claims, adfs, classic etc). then make sure same authentication configured in your test farm. then you will be all set.

here are couple of guidline for the migrating users which will help you

After migrating my web application from SP2010 to SP2013, I get access denied error

SharePoint 2013: Migrate users from Windows to Claims Authentication

Answer 2

Solution found... kind of.
Inspired by https://gallery.technet.microsoft.com/office/SharePoint-2013-Migrate-bbf4ae4d

This fixes the issue for most accounts, but runs into problems with group accounts and accounts without an email address. I'd say I'm 85% of the way there. I'm going to keep looking. Here's the code I have so far. Hopefully it will help anyone else who has the same issue.

function MigrateUsers($SiteCollUrl) 
{ 
    $site = Get-SPSite $SiteCollUrl 
    $web = $site.OpenWeb() 
    $groups = $web.sitegroups 
    $warning = 0

    foreach ($grp in $groups) { 
        write-host "Group: " + $grp.name -BackgroundColor Cyan -ForegroundColor DarkBlue  ;
        $groupName = $grp.name 
        foreach ($user in $grp.users) {
                "User: " + $user.name 
                    If(!$user.email)
                        {write-host "Skipping " $user.name -ForegroundColor Yellow
                        $warning = $warning + 1
                        write-host $warning " warnings"
                    }   
                    Else {
                        $userId = $user.email
                        $grp.RemoveUser($user); 
                        $user1 = $web.Site.RootWeb.EnsureUser($userId) 

                        $grp.AddUser($user1)          
                        write-host "User " $userId   " added to  " $groupName -foregroundcolor green 
                    }
        }  
    }  
    write-host "you have " $warning " accounts to manually fix" -BackgroundColor Red -ForegroundColor DarkBlue
}