When I run this script,

$site = new-object Microsoft.SharePoint.SPSite($SiteCollectionURL) 
$web = $site.openweb() 
$siteUsers = $web.SiteUsers 

foreach($user in $siteUsers) 
    if($user.IsSiteAdmin -eq $true) 
       Write-Host "ADMIN: ", $user.LoginName 
        Write-Host "USER: ", $user.LoginName 

I get this output

ADMIN: i:0#.w|exampledomain\my.user


Any idea why ?


New-SPSite 'https://example1.myportal.com/us/SCTest1' -HostHeaderWebApplication 'https://example1.myportal.com’ -Name 'SCTest1' -Description '' -OwnerAlias 'exampledomain\myuser.name' -language 1033 -Template 'STS#1'

When I create a site collection like this, I still get same output as above,

ADMIN: i:0#.w|exampledomain\myuser.name


  • Have you migrated your SharePoint server from SP2010, or changed the authentication mode to claims?
    – Evariste
    Mar 29, 2018 at 12:02
  • @Evariste nope it's not a migrated site :( Mar 29, 2018 at 12:12
  • Do you have a specific problem with that kind of difference?
    – MHeld
    Mar 29, 2018 at 12:30
  • yes, alerts added by code using standard template are working regardless of i:0#.w| or not in user login, however they won't work if username don't have i:0#.w|, I fixed the issue using .ToUrlEncode but I want to understand why this is happening Mar 29, 2018 at 13:37
  • 1
    @MHeld I added wrong script, I just realized so sorry... I updated it now Apr 9, 2018 at 12:00

1 Answer 1


I did a lot of testing regarding this issue. I will share my results, even if I cannot provide a perfect answer.

  • I am able to reproduce this behavior on several SharePoint machines from SharePoint 2010 to 2016 when creating a SiteCollection.
  • The current User gets added as SiteCollection owner with the claim-encoded identity (i:0#.w|domain\user). It always gets ID 1.
  • The domain-identity (domain\user) is created with no permissions. It always gets ID 3. It is invisible in the Hidden User List of the SiteCollection
  • I have found a VERY old documentation with the users which will get created out-of-the-box. Based on this documentation, my thinking is:
    • The SiteCreation-Account still gets ID 1, but is claims-encoded today.
    • Warning: Pure speculation here! The domain-account still gets created for historical reasons with ID 3.
  • This old UserInfo table documentation tells us about ID 1 (SC Owner), ID 2 (Secondary owner) and 1073741823 (System). These seem to be still valid, but again: ID 3 is missing.
  • A newly created SiteCollection still works if i remove the domain-user (ID 3). Not sure if stuff will be assigned to the user if the site is used.
  • Here is another unsuccessful discussion about a similar topic.
  • If you convert the entire WebApplication with Convert-SPWebApplication -Identity <URL> -From Legacy -To Claims -RetainPermissions, all ID3 accounts are rewritten to a claims-identity. If you create a new SiteCollection afterwards, ID3 gets a domain-identity again only on the new SiteCollection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.