AD User group membership propagation issue
In some rare instances, users may exist within a Site Collection that don’t receive their AD group membership updates.
I’ve traced this down to recreated AD users that have the same account name, yet a new SID. The solution is to wipe the user references from the site collection.
Be forewarned, any user permissions will be wiped as well. One more excellent reason to only use AD groups for assigning permissions in SharePoint!
You can see this internal list and even delete the user by adapting this URL:
http ://WebApp/ManagedPath/namedSiteCollection/_layouts/people.aspx?MembershipGroupId=0
Better to do it in PowerShell for speed, extensibility, consistency, and across many site collections. The trick comes down to a specific way to eliminate the user from the site collection:
|
1
|
$RootWeb.SiteUsers.Remove($MyUser) |
Note trying $RootWeb.Users.Remove($MyUser) or $RootWeb.AllUsers.Remove($MyUser) will not work.
To finish it off, I prefer to re-add the user:
|
1
|
$RootWeb.EnsureUser($MyUser) |
Here’s the full script, where I traverse through site collections in a Web App, filter them based on criteria (in this case the managed path), then carefully take the action on a list of users (one or more, comma separated), and output any failures along the way:
Start-SPAssignment –Global $UsersToWipe = "DOMAINPoorBloke" $UsersToWipeArray = $UsersToWipe.Split(“,”) $siteUrl = "http ://SharePoint" Write-Host "script starting $(get-date)" $rootSite = New-Object Microsoft.SharePoint.SPSite($siteUrl) $spWebApp = $rootSite.WebApplication foreach($site in $spWebApp.Sites) { if ($site.Url -notlike "$siteurl/SpecificPath/*") { Write-Host "Fast Skipping $($site.Url)" } else { $rootWeb = $site.RootWeb; foreach ($MyUser in $UsersToWipeArray) { try { try { $user1 = $RootWeb.EnsureUser($MyUser) } catch { Write-Host "x1: Failed to ensure user $($MyUser) in $($Site.url)" } try { $RootWeb.SiteUsers.Remove($MyUser) $RootWeb.update() } catch { Write-Host "x2: Failed to remove $($MyUser) from all users in $($Site.url)" } try { $user1 = $RootWeb.EnsureUser($MyUser) } catch { Write-Host "x3: Failed to ensure user $($MyUser) in $($Site.url)" } } catch { Write-Host "x4: other failure for $($MyUser) in $($Site.url)" } } } #Site to process $site.Dispose(); } #foreach Site Write-Host "script finishing $(get-date)" Stop-SPAssignment –Global |
Want to talk?
Drop us a line. We are here to answer your questions 24*7.