I have a SharePoint site which is setup with claims based authentication. My Central Admin site is setup for Windows authentication as it normally is.

Now in my ULS logs, I find a lot of messages like:

No windows identity for DOMAIN\user

When you look this up, there are multiple explanations which I've checked all, without any luck.

What I think is, that my default content access account, which is configured as DOMAIN\user causes trouble with my claims based site. Finding a Windows Identity for a claims based site would only work for a claims based account I suppose.

If that makes sense, it would also make sense to set a claims based account as the content access account, right? Well that's easier said then done apparantly. When I enter a claims based name, the form says it's invalid. That could be because the central administration isn't claims based? The weird thing is that I have multiple authentication providers configured which I can use without problem in other parts of Central Administration.

I searched if there's a way to do so in Powershell, but didn't find a promising one. The SetDefaultGatheringAccount method takes a username and a password, so not a real good way to set a claims based account?

So my questions; 1) Is is better to use a claims based content access account to crawl claims based sites? 2) Is is possible to set a claims based content access account? 3) If so: how?


  • Is this a web application that has been converted from classic to claims? Commented Jun 6, 2012 at 19:50
  • Yes, I believe it is.
    – Jasper
    Commented Jun 3, 2013 at 8:42

1 Answer 1


You should extend your web app and use a different zone for which you use the claims Auth (for instance the Intranet zone). Let the Default zone use NTLM Auth and crawl that zone.

Search can only crawl using windows Auth. And the default zone should be the most secure.

  • 3
    Not necessarily! You must understand the difference of a Claims mode Web Application and a Classic mode Web Application. Both can use Windows AuthN/NTLM - and that is what is required (ie Windows claims). Commented Jun 6, 2012 at 19:49
  • I still think it's the right thing to do, if he doesn't want windows enabled for his claims zone Commented Jun 6, 2012 at 19:57
  • Well, this is a design issue and is only necessary if windows authn is not enabled at all on that web app. Commented Jun 7, 2012 at 5:38
  • I have Windows enabled for my default zone. Our external users log in via forms, internal users via Windows / AD. But on logon, the Windows account is translated to a claim and apparantly something doesn't work quite right there for the default content access account.
    – Jasper
    Commented Jun 7, 2012 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.