I am working on developing a server side event receiver inside sharepoint on-premises farm 2013. Inside the code i have the following, which will retrieve a string from a drop down list column representing a user name such as (User.A). the drop down list column name is OrderAssignToApprover , then I will convert the string to SPUSer:-

string approver = currentItem["OrderAssignToApprover"].ToString();
SPUser spUser = properties.Site.RootWeb.EnsureUser(approver);

now for certain user only the EnsureUser will return this exception:-

The specified user User.A could not be found. 

so i thought that the user is deleted or is disabled, but i try adding the user to a sharepoint security group and assign it to a people or group field, and i was able to do so without any problem.. so seems the user is valid, but not sure why EnsureUser will return an exception..

EDIT. Now i checked with our system admins and seems the user's account was disabled inside the AD. so this means that EnsureUser will not work on accounts which have been disabled. so now my question should be if there is a way to convert a string (representing a user's login name) to SPUser object, while the username's account is disabled inside AD?? seems EnsureUser will not support this.. so are there other function or workarounds?

  • Did u get the solution? Mar 22, 2018 at 17:27
  • Those disable information help me with my problem. TQ.
    – Ariwibawa
    Oct 21, 2019 at 8:38

4 Answers 4


Can you check if the user's are still enabled in AD? This error can be occurred as if the user is not enabled in AD, though it will still show as an SP User.

Please let me know what happens.

  • i checked with our system admin and the user account has been disabled last week, so this clearly explain why the EnsureUser() start raising exception on it... so now my question is how i can convert a string representing a user login name such as (User.ABC) to an SPUser object regardless if the user is enabled ot disabled inside AD ??
    – John John
    Mar 19, 2018 at 13:27
  • 1
    If it is disable in AD, most of the case you can't get the SPUser object or any other metadata. Though there are some workaround which are not suggested and has some draw back as like wrong information and so others. Please remember to mark your question as "answered" if this solves your problem. Mar 20, 2018 at 18:21
  • 1
    The resolution methods within SharePoint explicitly filter out disabled objects when querying Active Directory. There's no work around and this is hard coded.
    – user6024
    Mar 25, 2018 at 20:20

There are few caveats you need to check when working with EnsureUser

EnsureUser will work only if the user is available in that particular Site collection. Check if user is available in any site group

If you have that user in your site collection, probably you need to get the encoded claim value to be passed to that method.

SPClaimProviderManager cpm = SPClaimProviderManager.Local;

SPClaim userClaim = cpm.ConvertIdentifierToClaim("domain\\username",


using (SPSite theSite = newSPSite(“https://www.contoso.com"))


     SPWeb theWeb = theSite.OpenWeb();

     SPUser theUser = theWeb.EnsureUser(userClaim.ToEncodedString());

  • Yes the user is there inside the site collection and the EnsureUser use to work well on this user using the same code.... But i checked with our system admins and they mentioned that the user was disabled from AD, this could explain why the EnsureUser start raising errors on this user. but now i am not sure if i can convert a string representing the user login name such as (User.ABC) to an SPUser object for disable and enabled AD users?? as seems EnsureUser will have a limitation on disabled AD users...
    – John John
    Mar 19, 2018 at 13:24

I worked with EnsureUser and found out that there are a few inconveniences. For example, we need almost always to use elevated privileges to deal with EnsureUser, otherwise exception will be thrown. Or for example, if user doesn't exist in user collection, it will be tried to add to this collection, but this means that spWeb object will be modified and it's required AllowUnsafeUpdates = true.
What does EnsureUser does is, "It checks whether the specified login name belongs to a valid user of the Web site, and if the login name does not already exist, adds it to the Web site." Which happens to be exactly what we want! Now we can finish our code:

SPUser newUser = newWeb.EnsureUser(string loginName);
newWeb.AllowUnsafeUpdates = true;
  • but in my case EnsureUser will work well without elevated privileges.. i tried running it with users who have contribute permission and it worked well...
    – John John
    Mar 19, 2018 at 13:28
  • elevated privileges is for adding users who not added into site and to add user to site/group.
    – Sunil Sahu
    Mar 20, 2018 at 5:29

As per the description of ENSUREUSER on MSDN the username should include domain name,so ensure domain name. Also the column OrderAssignToApprover should be of type User.


  • i do not think the domain name is required in my case, as i mentioned the command will work well for other users, where i am not passing the domain name for them... also i tired passing the domain name but still i am getting the same error... i think the problem with the user itself? could the user be disabled or deleted? but as i mentioned i am able to reference him inside a sharepoint security group + inside people and group columns ..
    – John John
    Mar 19, 2018 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.