Background: I am fairly new to administering SharePoint and have inherited this environment, but we are currently migrating to a new domain (domain B) and SP exists in the old domain (domain A).

Goal: connect our current SP to both domains (people picker) and do a move user in SP from domainA\username to domainB\username so that access to all their sites and rights remain intact when their account is moved to domainB.

I know this has been discussed, but Im more looking for a solid step by step as my Sharepoint powershell is basically non-existant, so any help would be appreciated.

Thanks in advance.

1 Answer 1


It will depend on the domain trust mode (two-way or one-way), but this topic is covered under Using People Picker with multiple forests or domains and Configure People Picker (SharePoint Server 2010).

A couple notes on this:

  1. The user object must be disabled in the source or destination forest. It is not supported to be enabled in both, and with the User Profile Sync Service, you may see unexpected migration activity within SharePoint if it is enabled in both forests.

  2. SharePoint servers cannot be moved between domains/forests. You must build a new farm in the target forest and perform a database migration for service applications and content databases.

Here's the full process:

$wa = Get-SPWebApplication https://url
$adsearchobj = New-Object Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain
$adsearchobj.DomainName = "contoso.com"
$adsearchobj.ShortDomainName = "CONTOSO" #Optional
$adsearchobj.IsForest = $true #$true for Forest, $false for Domain

Do this for each forest and Web Application.

When you move a user object from one forest to another, find a site collection URL where the user object exists and run:

$user = Get-SPUser https://siteCollUrl
Move-SPUser -Identity $user -NewAlias 'i:0#.w|newdomain\username' -IgnoreSid

You can also run:

stsadm -o migrateuser -oldlogin 'i:0#.w|olddomain\username' -newlogin 'i:0#.w|newdomain\username' -ignoresidhistory

  • So currently it is a two-way trust between the source and target domain, and the plan is to move the current SharePoint environment to SharePoint online so it will be staying active in the old domain until then.
    – Aganim
    Nov 15, 2019 at 14:56
  • You can still follow the instructions above, however you do not need to set an Application Credential Key nor do you need to specify a username or password on the connection for the People Picker.
    – user6024
    Nov 15, 2019 at 15:42
  • I guess what Im really looking for is solid step by step for someone who isnt too familiar with SharePoint Powershell that will allow me to have people picker look at both domains, move the user rights, and check to make sure it didnt break anything in the process, and I cant seem to find that.
    – Aganim
    Nov 15, 2019 at 18:22
  • Updated my answer.
    – user6024
    Nov 16, 2019 at 18:32
  • This is excellent. Thank you so much for the detailed explanation. I greatly appreciate it.
    – Aganim
    Nov 18, 2019 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.