Why some users are missing “i:0#.w|”

Question

When I run this script,

$site = new-object Microsoft.SharePoint.SPSite($SiteCollectionURL) 
$web = $site.openweb() 
$siteUsers = $web.SiteUsers 

foreach($user in $siteUsers) 
{        
    if($user.IsSiteAdmin -eq $true) 
    { 
       Write-Host "ADMIN: ", $user.LoginName 
    } 
    else 
    { 
        Write-Host "USER: ", $user.LoginName 
    } 
}    

I get this output

ADMIN: i:0#.w|exampledomain\my.user

USER: EXAMPLEDOMAIN\my.user

Any idea why ?

Update:

New-SPSite 'https://example1.myportal.com/us/SCTest1' -HostHeaderWebApplication 'https://example1.myportal.com’ -Name 'SCTest1' -Description '' -OwnerAlias 'exampledomain\myuser.name' -language 1033 -Template 'STS#1'

When I create a site collection like this, I still get same output as above,

ADMIN: i:0#.w|exampledomain\myuser.name

USER: EXAMPLEDOMAIN\myuser.name

Answer 1

I did a lot of testing regarding this issue. I will share my results, even if I cannot provide a perfect answer.

• I am able to reproduce this behavior on several SharePoint machines from SharePoint 2010 to 2016 when creating a SiteCollection.
• The current User gets added as SiteCollection owner with the claim-encoded identity (i:0#.w|domain\user). It always gets ID 1.
• The domain-identity (domain\user) is created with no permissions. It always gets ID 3. It is invisible in the Hidden User List of the SiteCollection
• I have found a VERY old documentation with the users which will get created out-of-the-box. Based on this documentation, my thinking is:
  • The SiteCreation-Account still gets ID 1, but is claims-encoded today.
  • Warning: Pure speculation here! The domain-account still gets created for historical reasons with ID 3.
• This old UserInfo table documentation tells us about ID 1 (SC Owner), ID 2 (Secondary owner) and 1073741823 (System). These seem to be still valid, but again: ID 3 is missing.
• A newly created SiteCollection still works if i remove the domain-user (ID 3). Not sure if stuff will be assigned to the user if the site is used.
• Here is another unsuccessful discussion about a similar topic.
• If you convert the entire WebApplication with Convert-SPWebApplication -Identity <URL> -From Legacy -To Claims -RetainPermissions, all ID3 accounts are rewritten to a claims-identity. If you create a new SiteCollection afterwards, ID3 gets a domain-identity again only on the new SiteCollection.