I am wondering if I can rerun Convert-SPWebApplication on a web app that has already been converted to ADFS, using the same command. We have multiple content databases and an NTLM version of a content database was restored to our UAT instance, overwriting the ADSF version. I want to convert it to ADFS again without having to use Move-SPUser on the specific site collection database.



I was able to re-run Convert-SPWebApplication on the web app. However, I first had to remove the trusted identity token issuer and trusted root authority:

Remove-SPTrustedIdentityTokenIssuer -Identity "ADFS" 
Remove-SPTrustedRootAuthority -Identity "ADFS Token Signing Cert Parent"

and then re-add it.

Next, I ran Convert-SPWebApplication using a database switch to point to the specific database:

$wa = Get-SPWebApplication -Identity "https://web.app.url"
$tp= Get-SPTrustedIdentityTokenIssuer "ADFS"
$skipList = "D:\ADFS\SkipList.csv"

$database = Get-SPContentDatabase -Identity "Content Database Name"

Convert-SPWebApplication -id $wa -To CLAIMS-TRUSTED-DEFAULT -From CLAIMS-WINDOWS -database $database -TrustedProvider $tp -SourceSkipList $skipList -RetainPermissions

I tried to run it without removing the trusted identity token issuer but it kept erring out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.