We attempted to convert a web app that was set up in claims back to NTLM/Windows auth.

First we unchecked the claims provider in the web app properties in CA. We realized we were still getting claims accounts registered in the user list with the claims account prefix "i:O#.w".

We then ran the following script on the web app:

$webApp = Get-SPWebApplication "http://mywebapp"
$webApp.UseClaimsAuthentication = 0;

This did change the web app setting to Classic. We then found we no longer had access to the site with any account.

We tried manually changing SC admins in CA to the Windows accounts. The changes were accepted, however access was still denied.

We also manually converted some accounts with the following script. Access was still denied after this.

stsadm -o migrateuser -oldlogin "i:0#.w|domain\userid" -newlogin domain\userid -ignoresidhistory

What did we miss?


As far as I know converting from Claims to classic isn't supported.

I'd delete the old web application, BUT keep the content database. Create a new web app using the old content database. Assign new windows site collection admin and the re-create all permissions using windows accounts groups.

| improve this answer | |

We didn't really find out what was missing. We found a few web.config settings that when removed allowed the site to work. That however just made us more nervous about where we were heading with all this.

So to be safe, we detached the content databases, recreated the web application and site collections, then reattached the content databases. It didn't take all that long to complete either.

| improve this answer | |

Use Powershell:

$webApp = Get-SPWebApplication "http://mywebapp"
| improve this answer | |
  • I have the same problem. Tried this, but it didn't work. – Renan May 9 '14 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.