We are currently running SP2010 within a development environment in a different domain. What I have been able to accomplish now is to create a cross forest trust so that users within the live domain can login (assuming rights are granted) to the development side. What I would like to do is change all of the current user access and ownership from their development side login (DEV\User1) to the live side (LIVE\User1) but am not sure exactly how to accomplish iterating through the entire sharepoint site and modifying these permissions. Has anyone done this before? Thanks!

2 Answers 2


I believe the only option is to do exactly that, iterate through the entire SharePoint site.

Here is a powershell script that I quickly rejigged to be more in-line with what you're looking to do. Hopefully it helps you, please do test it out on DEV first because it is untested, and will likely need modifications because I've never actually done what you're looking to do.

You give it a site, and it will recurse to the depths doing what it does. Provided that it works of course. Sorry I can't give you more, hope this is at least useful. The site recursion stuff works, but the username change stuff might not, hopefully some other ppl will provide insight into that.

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

$oldDomain = "oldDomainHere"
$newDomain = "newDomainHere"

# this function will recurse to the farthest depths of the site.
function RecurseWebPermFix() {

    Write-Output "Site: $($Site.Url)"

    foreach($user in $Site.Users)
        $newLogin = $user.UserLogin -replace $oldDomain, $newDomain
        $user.UserLogin = $newLogin
        Write-Output "changing $($user.UserLogin) -> $($newLogin)"

    if($SiteIdentity.Webs.Count -gt 0)
        foreach($subWeb in $SiteIdentity.Webs)
            RecurseWebPermFix -Site $subWeb

$siteColl = Get-SPSite "http://your.root.spsite/"
RecurseWebPermFix -Site $($siteColl.RootWeb)
  • Well the looping appears to be working correctly however the userlogin property is read only so that will not be working...
    – Brian
    Oct 8, 2012 at 16:54

My script to transfer ownership of any users, sharepoint groups, and AD Domain groups:

$site = get-spsite http://portal/
foreach ($web in $site.allwebs) {
$groupprefix = "NEW_DOMAIN\"
$userprefix = "NEW_DOMAIN\"
$users = get-spuser -web $web.url
foreach($user in $users)
    $a= @()
    $displayname = $user.DisplayName
    $userlogin = $user.UserLogin
    if((!$userlogin.Contains("administrator")) -and (!$userlogin.Contains("LOCAL SERVICE")) -and (!$userlogin.Contains("authenticated users")) -and (!$userlogin.Contains("ID-TokenIssuer")) -and (!$userlogin.Contains("system")) -and (!$userlogin.Contains($groupprefix)))
        Write-Host $userlogin
        $isgroup = $user.IsDomainGroup
        $username = ""
        if(!$isgroup) # for users
            $a = $userlogin.split("\")
            $username = $userprefix + $a[1]
            Move-SPUser $user -NewAlias $username -ignoresid -Confirm:$false
        elseif($isgroup) #for groups
           Write-Host "---------- OLD LOGIN -------"
           Write-Host $userlogin
           $a = $displayname.split("\")
           $username = $groupprefix + $a[1]
           stsadm -o migrategroup -oldlogin $displayname -newlogin $username
           $group = $site.RootWeb.SiteUsers[$userlogin]
           write-host $username
           Write-Host "------- EOL ----------"
           $group.Name = $username


Then to rename the groups after the STSADM migrate:

$site = New-Object -TypeName Microsoft.SharePoint.SPSite -ArgumentList <url>
$group = $site.RootWeb.SiteUsers["<domain\group>"]
$group.Name = "<updated group name>"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.