SharePoint 2013: Add Second Domain to PP and Move User

Question

Background: I am fairly new to administering SharePoint and have inherited this environment, but we are currently migrating to a new domain (domain B) and SP exists in the old domain (domain A).

Goal: connect our current SP to both domains (people picker) and do a move user in SP from domainA\username to domainB\username so that access to all their sites and rights remain intact when their account is moved to domainB.

I know this has been discussed, but Im more looking for a solid step by step as my Sharepoint powershell is basically non-existant, so any help would be appreciated.

Thanks in advance.

Answer 1

It will depend on the domain trust mode (two-way or one-way), but this topic is covered under Using People Picker with multiple forests or domains and Configure People Picker (SharePoint Server 2010).

A couple notes on this:

1. The user object must be disabled in the source or destination forest. It is not supported to be enabled in both, and with the User Profile Sync Service, you may see unexpected migration activity within SharePoint if it is enabled in both forests.

2. SharePoint servers cannot be moved between domains/forests. You must build a new farm in the target forest and perform a database migration for service applications and content databases.

Here's the full process:

$wa = Get-SPWebApplication https://url
$adsearchobj = New-Object Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain
$adsearchobj.DomainName = "contoso.com"
$adsearchobj.ShortDomainName = "CONTOSO" #Optional
$adsearchobj.IsForest = $true #$true for Forest, $false for Domain
$wa.PeoplePickerSettings.SearchActiveDirectoryDomains.Add($adsearchobj)
$wa.Update()

Do this for each forest and Web Application.

When you move a user object from one forest to another, find a site collection URL where the user object exists and run:

$user = Get-SPUser https://siteCollUrl
Move-SPUser -Identity $user -NewAlias 'i:0#.w|newdomain\username' -IgnoreSid

You can also run:

stsadm -o migrateuser -oldlogin 'i:0#.w|olddomain\username' -newlogin 'i:0#.w|newdomain\username' -ignoresidhistory