# Access Denied Error after migrating to SharePoint 2013

- Link: https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/
- Published: 2016-02-12T16:22:02+05:30
- Author: Deviprasad Panda

Access Denied Error after migrating to SharePoint 2013

**Scenario**:

We were working for a client, they had many groups and we had to build a collaboration
portal for all the groups. Key thing was few sites of some groups were already present
in SharePoint 2010 in different standalone servers. Migration was a key thing here
as the existing sites has huge data, and huge user base.

The Requirement was to build a portal /web application which will have migrated 
sites and new set of sites as per agreed site structure. According to the agreed
architecture and design we created a new web application and started building the
site hierarchy.

As part of this we followed the regular approach database detach –attach method 
and migrated the existing SharePoint 2010 site .Migration was successful and we 
were able to access the site  with the system account. Later we tried with couple
of site admin accounts, to our surprise we were getting “ACCESS DENIED” with any
other user id.

**Background:**

By default when we create a web application in SharePoint 2013, it gets created 
with Claims authentication. When we migrate the content DB to 2013, it recognizes
the user account only in this format **i:0#.w|domainusername** . Though it’s an 
AD account it no more recognizes the **DomainUserName** format.

SharePoint assumes all users to be claim users and renders them so. Therefore, a
normal windows user – “DomainUserName” appears as “i:0#.w|DomainUserName”. Moreover,
it uses the username in this same format to check for its permissions but does not
find a matching entry for the user as the database has windows users – “DomainUserName”.
So, the site will give you an access denied.

Note that the System Account will work since its “DomainUserName” is never used 
and System Account is a keyword used by SharePoint for the application pool identity.
Therefore, it remains unaffected.

**Solution:**

In brief the share point 2010 site which needs to be migrated should be converted
to claims format and then migrate it to 2013. But a word of caution , **do not directly
change the SP 2010 site to claims format** in a production environment as it will
not allow existing windows accounts to login and existing SharePoint 2010 site will
be no more operational.

Below power shell script converts classic mode site to claims mode:

[⌊Power shell script⌉⌊Power shell script⌉[

This script converts user accounts to claims format:

[⌊Script for converting user accounts to claims format⌉⌊Script for converting user
accounts to claims format⌉[

On executing the first script (to enable claims authentication) the SharePoint Content
Database is made ready for claims based authentication but the already existing 
site users were windows users, are not “migrated” to be understood by claims authentication.

We use the second script to “migrate” the users. MigrateUser($true) will convert
all user accounts to claims format. After running this script user accounts are 
converted in the database to claims format, therefore, user names are read correctly
by SharePoint therefore, permissions for users are associated correctly by SharePoint
hence the site permissions work correctly.

**Note:**

By any chance if you execute these scripts directly in productions, by executing****
$webapp.MigrateUsers($false) will not convert user accounts to windows mode, rather
it will throw an exception. Make sure you have a temporary environment built where
you execute the above scripts. Also note that these scripts are running on Web Applications
so they will affect all site collections in that web application

### Share this:

 * [  X ](https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/?share=twitter)
 * [  Facebook ](https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/?share=facebook)
 * [  WhatsApp ](https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/?share=jetpack-whatsapp)
 * [  Email ](https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/?subject=%5BShared%20Post%5D%20Access%20Denied%20Error%20after%20migrating%20to%20SharePoint%202013&body=https%3A%2F%2Fsharepointtechnicalsupport.com%2F2016%2F02%2F12%2Faccess-denied-error-after-migrating-to-sharepoint-2013%2F&share=email)
 * [  Telegram ](https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/?share=telegram)
 * [  LinkedIn ](https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/?share=linkedin)
 * [  Tumblr ](https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/?share=tumblr)
 * [  Pinterest ](https://sharepointtechnicalsupport.com/2016/02/12/access-denied-error-after-migrating-to-sharepoint-2013/?share=pinterest)

### Like this:

Like Loading…

### _Related_