We have the following script that was running on sharepoint 2010 where we had clasic windows authentication.

When we moved to SP 2013, the authentication was changed to Claims.

The following code doesnt work anymore on Sp 2013

$spsite = new-object Microsoft.SharePoint.SPSite("https://mysite.com/");
$web = $spsite.openweb("/subsite1/subsite2/")
$removeUser = $web.AllUsers["domainname\username"];

I have to add the claims thing to make it work

$spsite = new-object Microsoft.SharePoint.SPSite("https://mysite.com/");
$web = $spsite.openweb("/subsite1/subsite2/")
$removeUser = $web.AllUsers["i:0#.w|domainname\username"];

How can I change this to make it work without the claim thingy!

  • You may want to use the SiteUsers collection rather than the AllUsers collection depending on the requirements. SiteUsers has the largest set of principals. Mar 3, 2014 at 15:47

1 Answer 1


Try this variant, replacing the AllUsers lookup with EnsureUser

$spsite = new-object Microsoft.SharePoint.SPSite("https://mysite.com/")
$web = $spsite.openweb("/subsite1/subsite2/")
$removeUser = $web.EnsureUser("domainname\username")

Or, if you do not wish to add the user to the site even to then delete him/ her, you can build on this functionality (could probably be improved a great bit):

$loginName = "domainname\username"
$users = Get-SPUser -Web $web.Url

foreach($user in $users)
         $removeUser = $user

Or, as this guy has done, implement a supporting method:

$m = [Microsoft.SharePoint.Administration.Claims.SPClaimProviderManager]::Local
Add-PSSnapin Microsoft.SharePoint.PowerShell -ea silentlycontinue 
Function Get-SPClaim {
    param ([string]$user)
    $claim = New-SPClaimsPrincipal -identity $user -IdentityType "WindowsSamAccountName"
    return $m.EncodeClaim($claim)

that you can use like:

$userWithClaim = get-SPClaim($loginName)
$removeUser = $web.AllUsers[$userWithClaim]
  • 2
    as far as I know ensureuser will add the user if it doesnt exist and I dont want that, I just want to know if the user exists or not to remove it later in the script. Mar 3, 2014 at 14:49
  • Yupp it will, but it is also one of your easiest way to get a reference to the user. If you do not want to add the user you can see my update Mar 3, 2014 at 14:53
  • Booo, I found the same thing but didn't see your update x). Mar 3, 2014 at 15:22
  • @CameronVerhelst Haha, sometimes you need to be fast and furious! Mar 3, 2014 at 15:26
  • When it concerns StackExchange reputation, definitely ;) Mar 3, 2014 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.