0

Background: I am fairly new to administering SharePoint and have inherited this environment, but we are currently migrating to a new domain (domain B) and SP exists in the old domain (domain A).

Goal: connect our current SP to both domains (people picker) and do a move user in SP from domainA\username to domainB\username so that access to all their sites and rights remain intact when their account is moved to domainB.

I know this has been discussed, but Im more looking for a solid step by step as my Sharepoint powershell is basically non-existant, so any help would be appreciated.

Thanks in advance.

0

It will depend on the domain trust mode (two-way or one-way), but this topic is covered under Using People Picker with multiple forests or domains and Configure People Picker (SharePoint Server 2010).

A couple notes on this:

  1. The user object must be disabled in the source or destination forest. It is not supported to be enabled in both, and with the User Profile Sync Service, you may see unexpected migration activity within SharePoint if it is enabled in both forests.

  2. SharePoint servers cannot be moved between domains/forests. You must build a new farm in the target forest and perform a database migration for service applications and content databases.

Here's the full process:

$wa = Get-SPWebApplication https://url
$adsearchobj = New-Object Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain
$adsearchobj.DomainName = "contoso.com"
$adsearchobj.ShortDomainName = "CONTOSO" #Optional
$adsearchobj.IsForest = $true #$true for Forest, $false for Domain
$wa.PeoplePickerSettings.SearchActiveDirectoryDomains.Add($adsearchobj)
$wa.Update()

Do this for each forest and Web Application.

When you move a user object from one forest to another, find a site collection URL where the user object exists and run:

$user = Get-SPUser https://siteCollUrl
Move-SPUser -Identity $user -NewAlias 'i:0#.w|newdomain\username' -IgnoreSid

You can also run:

stsadm -o migrateuser -oldlogin 'i:0#.w|olddomain\username' -newlogin 'i:0#.w|newdomain\username' -ignoresidhistory

  • So currently it is a two-way trust between the source and target domain, and the plan is to move the current SharePoint environment to SharePoint online so it will be staying active in the old domain until then. – Aganim Nov 15 at 14:56
  • You can still follow the instructions above, however you do not need to set an Application Credential Key nor do you need to specify a username or password on the connection for the People Picker. – Trevor Seward Nov 15 at 15:42
  • I guess what Im really looking for is solid step by step for someone who isnt too familiar with SharePoint Powershell that will allow me to have people picker look at both domains, move the user rights, and check to make sure it didnt break anything in the process, and I cant seem to find that. – Aganim Nov 15 at 18:22
  • Updated my answer. – Trevor Seward Nov 16 at 18:32
  • This is excellent. Thank you so much for the detailed explanation. I greatly appreciate it. – Aganim Nov 18 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.