Microsoft KB Archive/896161

= A user can no longer access SharePoint Portal Server 2003 after you migrate that user from one Active Directory domain to another Active Directory domain =

Article ID: 896161

Article Last Modified on 4/24/2007

-

APPLIES TO


 * Microsoft Office SharePoint Portal Server 2003

-





SYMPTOMS
After you migrate a user from one Active Directory domain to another Active Directory domain, that user experiences one of the following symptoms:
 * The user can no longer access Microsoft Office SharePoint Portal Server 2003.
 * The user can access SharePoint Portal Server 2003, but that user's settings are no longer the same as they were before the migration.



CAUSE
When a user is migrated in the Active Directory directory service, the security identifier (SID) changes for that user. Additionally, the logon information for that user might be changed. Microsoft Windows SharePoint Services 2003 and SharePoint Portal Server 2003 store user information based on both the user's SID and the user's logon information. When the user's SID or logon information changes in Active Directory, Windows SharePoint Services 2003 and SharePoint Portal Server 2003 must be updated with the new user information before that user can successfully access SharePoint Portal Server 2003.



RESOLUTION
This problem was first fixed in a hotfix that is now contained in a service pack. If you installed the latest SharePoint Portal Server 2003 service pack, you do not have to install the hotfix.

Service pack information
This problem is corrected in Microsoft Office SharePoint Portal Server 2003 Service Pack 2.

To resolve this problem, obtain the latest service pack for SharePoint Portal Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889380 How to obtain the latest service pack for SharePoint Portal Server 2003

How to obtain the hotfix
A supported API that you can use to update SharePoint Portal Server 2003 with new user information is included in the SharePoint Portal Server 2003 post-Service Pack 1 hotfix package that is dated March 25, 2005.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

896357 Description of the SharePoint Portal Server 2003 post-Service Pack 1 hotfix package: March 25, 2005

API information
The SharePoint Portal Server 2003 post-Service Pack 1 hotfix package that is dated March 25, 2005 contains an API that you can use to update SharePoint Portal Server 2003 with the migrated user information. This new API is made up of a new class that is named PortalAccountMigrationManager. This new class is added to the Microsoft.SharePoint.Portal namespace. This new class contains a new method that is named MigrateAccount.

The PortalAccountMigrationManager class
The PortalAccountMigrationManager class provides account migration support for a SharePoint Portal Server application.

System.Object

Microsoft.SharePoint.Portal.PortalAccountMigrationManager
[Visual Basic .NET]

Public Class sealed PortalAccountMigrationManager Inherits System.Object [Visual C#]

public class sealed PortalAccountMigrationManager : System.Object

Public methods
The following table shows the methods of the PortalApplication class together with a brief description of each method.

For more information about the GetContext method of the PortalApplication class, visit the following Microsoft Web site:

http://msdn2.microsoft.com/en-us/library/ms969722.aspx

Thread safety
The following members of the thread safety type are safe for multithreaded operations:
 * Public static members
 * Shared members in Visual Basic

Any instance members may not be safe for multithreaded operations.

Requirements
 Namespace

Microsoft.SharePoint.Portal

Note For more information about the Microsoft.SharePoint.Portal namespace, visit the following Microsoft Web site:

http://msdn2.microsoft.com/en-us/library/ms970862.aspx

 Operating system

Microsoft Windows Server 2003 Assembly

Microsoft.SharePoint.Portal in Microsoft.SharePoint.Portal.dll Security

Code Access Security

Note For more information about Code Access Security, visit the following Microsoft Web site:

http://msdn2.microsoft.com/en-us/library/ms954030.aspx



The MigrateAccount(String, String, Bool) method
The MigrateAccount method of the PortalAccountMigrationManager class updates SharePoint Portal Server with the new account information for the account that you specify. [Visual Basic .NET] Public Shared Function MigrateAccount( _  ByVal strOldAccountName As String, _   ByVal strNewAccountName As String _   ByVal bEnforceSidHistory As Bool _ ) As Bool [C#] public static bool MigrateAccount(  string strOldAccountName,   string strNewAccountName,   bool bEnforceSidHistory );

Parameters

 * Replace this value with the original pre-migration user name of the migrated user. This user name must be in the \  format.
 * Replace this value with the new post-migration user name of the migrated user. This user name must be in the \  format.
 * Set this value to True to require that the SID history of the user who you specified by using the  value contains the SID of the user who you specified by using the   value. Alternatively, to not verify the SID history, set the   value to False.

Return value
The return value is True if no errors occur. Otherwise, the return value generates an exception.

Notes  The MigrateAccount method only updates SharePoint Portal Server 2003 settings. You must also update Microsoft Windows SharePoint Services settings by using the Windows SharePoint Services MigrateUser method.

For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

896593 After you migrate a user from a different Active Directory domain, the user can no longer access Windows SharePoint Services

Important You must run the Windows SharePoint Services migration API before you run the SharePoint Portal Server 2003 API.</li> The MigrateAccount method locates any SharePoint Portal Server 2003 settings that are associated with the Windows logon and the SID of the original account. Then, the MigrateAccount method replaces the settings with the Windows logon and the SID of the new account. If the bEnforceSidHistory value is set to True, the MigrateAccount method requires that a SID is located for the original account and that this SID is part of the Active Directory SID history of the new account.</li> To help increase security, we recommend that you set the bEnforceSidHistory value to True when you call the MigrateAccount method. Only set the bEnforceSidHistory value to False if the SID history is not available or if the SID history is incomplete.</li> After the MigrateAccount method successfully finishes running, the following SharePoint Portal Server 2003 settings are updated for all the portals in the server farm:  User profile information</li> Area contact information</li> Person listing information</li> Audience rule information</li></ul> </li> The MigrateAccount method updates all the portals in a server farm. Therefore, only run the MigrateAccount method one time for each server farm. You must call the MigrateAccount method from within the context of a user who has Central Administrator privileges in the server farm that you want to update.</li> For a shared-services scenario within a server farm, the MigrateAccount method updates the master portal and all the child portals in the server farm. For a shared-services scenario between server farms, run the MigrateAccount method one time in the child server farm and one time in the master server farm.</li> If an error occurs when you run the MigrateAccount method, an exception is generated. This exception generally includes an error code that indicates the reason that the error occurred.</li> To obtain more detailed information about the migration process, see the portal diagnostic log. This log is named after the executable that called the MigrateAccount method. The timestamp of the log file creation date is appended to the name. To view more information, set the logging level for third-party applications to Information.</li></ul>

Hotfix installation information
This hotfix installation is made up of the following two parts:
 * The SharePoint Portal Server 2003 update
 * The Microsoft SQL Server 2000 Stored Procedure update

Important You must run the Windows SharePoint Services migration API before you run the SharePoint Portal Server 2003 API. For more information, see the &quot;Notes&quot; section.

The SharePoint Portal Server 2003 update
This part of the hotfix installation prevents the problems that are mentioned in this article in any new portal sites that you create in SharePoint Portal Server 2003. To update SharePoint Portal Server 2003, follow these steps:
 * 1) Run the self-extracting hotfix package to extract the hotfix files to a folder on the computer.
 * 2) Double-click the extracted hotfix package to start the hotfix installation.
 * 3) If you are prompted to insert the SharePoint Portal Server 2003 CD, insert the CD, and then click OK.
 * 4) Follow the remaining steps in the Setup program to update SharePoint Portal Server 2003.

The Microsoft SQL Server 2000 Stored Procedure update
This part of the hotfix installation makes sure that SharePoint Portal Server 2003 has all the fixes that are contained in this hotfix applied to each existing portal site. You must follow these steps for each existing portal site. Use one of the following procedures, depending on the kind of back-end database server that you are using.

For a Microsoft SQL Server 2000 back-end database server

 * 1) Run the self-extracting hotfix package to extract the hotfix files to a folder on the computer.
 * 2) Start SQL Query Analyzer, and then connect to the instance of SQL Server that is specified in your configuration.
 * 3) In the list of databases, click the   1_PROF database. In this database name,   is the name of your existing portal.
 * 4) On the File menu, click Open, locate the Sps_migratesids_profdb.sql file that you extracted from the hotfix package, and then click Open.
 * 5) On the Query menu, click Execute.
 * 6) After the query has successfully finished running, click Exit on the File menu.
 * 7) Repeat steps 2 through 6 for the _SITE database. In this case, run the Sps_migratesids_sitedb.sql query instead of the Sps_migratesids_profdb.sql query.

For a Microsoft MSDE back-end database server
<ol> Run the self-extracting hotfix package to extract the hotfix files to a folder on the computer.</li> At a command prompt, type the following command, and then press ENTER:

osql -S \SHAREPOINTPORTAL -d  1_PROF -n -E -i  \Sps_migratesids_profdb.sql

 Replace  with the name of the computer.</li> <li>Replace  with the name of your existing portal.</li> <li>Replace  with the path of the extracted hotfix files.</li></ul> </li> <li>After the query has successfully finished running, type exit, and then press ENTER.</li> <li>Repeat step 2 for the _SITE database. In this case, specify your site database instead of 1_PROF, and run the Sps_migratesids_sitedb.sql query instead of the Sps_migratesids_profdb.sql query.</li></ol>

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section. This problem was first corrected in SharePoint Portal Server 2003 Service Pack 2.

<div class="moreinformation_section">

MORE INFORMATION
For more information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Important If you want to migrate a user to SharePoint Portal Server 2003 by using the procedure that is described in this article, you must first migrate the user to Windows SharePoint Services by using the hotfix that is mentioned in the following Microsoft Knowledge Base article:

896593 After you migrate a user from a different Active Directory domain, the user can no longer access Windows SharePoint Services

Additional query words: SPS 2003 WSS

Keywords: kbshareptportalsvr2003sp2fix kbqfe kbhotfixserver kbshareptportalsvr2003presp2fix kbfix kbbug kbshareptportalsvr2003presp1fix KB896161

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.