AD Group membership not updating in Sharepoint 2010 when adding Active Directory group to Sharepoint group

Question

I have SharePoint 2010 installed with the latest CU updates. The farm account is a domain user and has been given all appropriate replication rights, etc. to active directory.

I created a SP website for the HR employees. Access to this website is granted trough several SP Groups (HR, Marketing, and Direction). I have a user who is a member of 3 AD groups. All those 3 AD groups have been added in the Direction group in my SharePoint website. But when I check the authorization for that user, SharePoint shows that the user has no access at all to the website. How come? I run the Profile Synchronisation service. I made a full Synch but nothing has changed. Any ideas?

Answer 1

->Try to go through the ULS logs incase the issue occurs outside the scope of the above mentioned. ->The permissions of the homepage or the page the user is trying to edit of the site collection or the document library where the homepage resides has the correct permissions. ->Analysis ? I ran a complete test to see what was actually going on:

1. First, I add user “DeleteUser” to a site collection, then I go to Content Database of site collection and open the UserInfo table.

2. I then delete “DeleteUser” from the site collection.

3. I check database again and find that the tp_Deleted column is set to the user’s ID, tp_IsActive column is set to 0 and tp_Token is set to NULL.

4. Everything is normal till now, but then I add a new “DeleteUser” in AD and add it back to SharePoint.

5. However, we can see “DeleteUser” is back with the same data as it had before being deleted.

The Issue:

The reused “DeleteUser” account can no longer access the SharePoint site! If we check the column tp_SystemID for which SID is being used in SharePoint, we find that this SID has not been changed. This is the explanation given by Microsoft: “when you added the user information to SharePoint, SharePoint updated the user’s existing entry in the UserInfo table instead of creating a new entry. However, the user security identifier (SID) in the old entry is no longer correct.” (please refer to kb982949)

Resolution:

I resolved the issue by deleting the “DeleteUser” entry in database and added this user again in SharePoint. However, this is not a very good way, as I have to reassign user’s permissions.

The right way is SharePoint 2010 Management Shell:

1. On the server that is running SharePoint, open Management Shell and type the following command

stsadm.exe -o migrateuser -oldlogin Domainname\OldUserName -newlogin Domainname\NewUserName ?ignoresidhistory

2. Press the “Enter” button.

3. After running the command, the database entry tp_SystemID changed and DeleteUser can once again logon.

Note: Run this command only from user accounts that are in the same domain. Otherwise, you may experience other permission problems. This command automatically updates the account name and the command maintains the appropriate permissions for the accou

Answer 2

Open SharePoint User Information List (Hidden List) as follows

http:///_catalogs/users/simple.aspx

and check whether the user added twice. If yes then please remove both first and again add that user.