A user can no longer access SharePoint Portal Server 2003 after you migrate that user from one Active Directory domain to another Active Directory domain (896161)

RESOLUTION

This problem was first fixed in a hotfix that is now contained in a service pack. If you installed the latest SharePoint Portal Server 2003 service pack, you do not have to install the hotfix.

Service pack information

This problem is corrected in Microsoft Office SharePoint Portal Server 2003 Service Pack 2.

To resolve this problem, obtain the latest service pack for SharePoint Portal Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix information

How to obtain the hotfix

A supported API that you can use to update SharePoint Portal Server 2003 with new user information is included in the SharePoint Portal Server 2003 post-Service Pack 1 hotfix package that is dated March 25, 2005.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

API information

The SharePoint Portal Server 2003 post-Service Pack 1 hotfix package that is dated March 25, 2005 contains an API that you can use to update SharePoint Portal Server 2003 with the migrated user information. This new API is made up of a new class that is named PortalAccountMigrationManager. This new class is added to the Microsoft.SharePoint.Portal namespace. This new class contains a new method that is named MigrateAccount.

The PortalAccountMigrationManager class

The PortalAccountMigrationManager class provides account migration support for a SharePoint Portal Server application.

System.Object

Microsoft.SharePoint.Portal.PortalAccountMigrationManager

[Visual Basic .NET]

Public Class sealed PortalAccountMigrationManager Inherits System.Object

[Visual C#]

public class sealed PortalAccountMigrationManager : System.Object

Public methods

The following table shows the methods of the PortalApplication class together with a brief description of each method.

Name	Description
MigrateAccount(String, String, Bool)	Updates SharePoint Portal Server with the new user information for the specified user. If the bEnforceSidHistory value is set to True, SharePoint Portal Server makes sure that the original user's SID is part of the SID history of the new user before performing the migration.
MigrateAccount(String, String)	Updates SharePoint Portal Server with the new user information for the specified user. Also makes sure that the original user's SID is part of the SID history of the new user before performing the migration.

For more information about the GetContext method of the PortalApplication class, visit the following Microsoft Web site: Thread safety

The following members of the thread safety type are safe for multithreaded operations:

• Public static members
• Shared members in Visual Basic

Any instance members may not be safe for multithreaded operations.

Requirements

• Namespace
  Microsoft.SharePoint.Portal
  
  Note For more information about the Microsoft.SharePoint.Portal namespace, visit the following Microsoft Web site:

  http://msdn.microsoft.com/library/default.asp?url=/library/en-us/spptsdk/html/nsPortal_SV01011478.asp

• Operating system
  Microsoft Windows Server 2003
• Assembly
  Microsoft.SharePoint.Portal in Microsoft.SharePoint.Portal.dll
• Security
  Code Access Security
  
  Note For more information about Code Access Security, visit the following Microsoft Web site:

  http://msdn.microsoft.com/library/default.asp?url=/library/en-us/spptsdk/html/SPCodeAccessSec_SV01077192.asp

The MigrateAccount(String, String, Bool) method

The MigrateAccount method of the PortalAccountMigrationManager class updates SharePoint Portal Server with the new account information for the account that you specify.

[Visual Basic .NET]
Public Shared Function MigrateAccount( _
   ByVal strOldAccountName As String, _
   ByVal strNewAccountName As String _
   ByVal bEnforceSidHistory As Bool _
) As Bool

[C#]
public static bool MigrateAccount(
   string strOldAccountName,
   string strNewAccountName,
   bool bEnforceSidHistory
);

Parameters

• strOldAccountName Replace this value with the original pre-migration user name of the migrated user. This user name must be in the domain\username format.
• strNewAccountName Replace this value with the new post-migration user name of the migrated user. This user name must be in the domain\username format.
• bEnforceSidHistory Set this value to True to require that the SID history of the user who you specified by using the strNewAccountName value contains the SID of the user who you specified by using the strOldAccountName value. Alternatively, to not verify the SID history, set the bEnforceSidHistory value to False.

Return value

The return value is True if no errors occur. Otherwise, the return value generates an exception.

Notes

• The MigrateAccount method only updates SharePoint Portal Server 2003 settings. You must also update Microsoft Windows SharePoint Services settings by using the Windows SharePoint Services MigrateUser method.
  
  For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

  896593 After you migrate a user from a different Active Directory domain, the user can no longer access Windows SharePoint Services

  Important You must run the Windows SharePoint Services migration API before you run the SharePoint Portal Server 2003 API.
• The MigrateAccount method locates any SharePoint Portal Server 2003 settings that are associated with the Windows logon and the SID of the original account. Then, the MigrateAccount method replaces the settings with the Windows logon and the SID of the new account. If the bEnforceSidHistory value is set to True, the MigrateAccount method requires that a SID is located for the original account and that this SID is part of the Active Directory SID history of the new account.
• To help increase security, we recommend that you set the bEnforceSidHistory value to True when you call the MigrateAccount method. Only set the bEnforceSidHistory value to False if the SID history is not available or if the SID history is incomplete.
• After the MigrateAccount method successfully finishes running, the following SharePoint Portal Server 2003 settings are updated for all the portals in the server farm:
  • User profile information
  • Area contact information
  • Person listing information
  • Audience rule information
• The MigrateAccount method updates all the portals in a server farm. Therefore, only run the MigrateAccount method one time for each server farm. You must call the MigrateAccount method from within the context of a user who has Central Administrator privileges in the server farm that you want to update.
• For a shared-services scenario within a server farm, the MigrateAccount method updates the master portal and all the child portals in the server farm. For a shared-services scenario between server farms, run the MigrateAccount method one time in the child server farm and one time in the master server farm.
• If an error occurs when you run the MigrateAccount method, an exception is generated. This exception generally includes an error code that indicates the reason that the error occurred.
• To obtain more detailed information about the migration process, see the portal diagnostic log. This log is named after the executable that called the MigrateAccount method. The timestamp of the log file creation date is appended to the name. To view more information, set the logging level for third-party applications to Information.

Hotfix installation information

This hotfix installation is made up of the following two parts:

• The SharePoint Portal Server 2003 update
• The Microsoft SQL Server 2000 Stored Procedure update

Important You must run the Windows SharePoint Services migration API before you run the SharePoint Portal Server 2003 API. For more information, see the "Notes" section.

The SharePoint Portal Server 2003 update

This part of the hotfix installation prevents the problems that are mentioned in this article in any new portal sites that you create in SharePoint Portal Server 2003. To update SharePoint Portal Server 2003, follow these steps:

1. Run the self-extracting hotfix package to extract the hotfix files to a folder on the computer.
2. Double-click the extracted hotfix package to start the hotfix installation.
3. If you are prompted to insert the SharePoint Portal Server 2003 CD, insert the CD, and then click OK.
4. Follow the remaining steps in the Setup program to update SharePoint Portal Server 2003.

The Microsoft SQL Server 2000 Stored Procedure update

This part of the hotfix installation makes sure that SharePoint Portal Server 2003 has all the fixes that are contained in this hotfix applied to each existing portal site. You must follow these steps for each existing portal site. Use one of the following procedures, depending on the kind of back-end database server that you are using.

For a Microsoft SQL Server 2000 back-end database server

1. Run the self-extracting hotfix package to extract the hotfix files to a folder on the computer.
2. Start SQL Query Analyzer, and then connect to the instance of SQL Server that is specified in your configuration.
3. In the list of databases, click the portal_name 1_PROF database. In this database name, portal_name is the name of your existing portal.
4. On the File menu, click Open, locate the Sps_migratesids_profdb.sql file that you extracted from the hotfix package, and then click Open.
5. On the Query menu, click Execute.
6. After the query has successfully finished running, click Exit on the File menu.
7. Repeat steps 2 through 6 for the _SITE database. In this case, run the Sps_migratesids_sitedb.sql query instead of the Sps_migratesids_profdb.sql query.

For a Microsoft MSDE back-end database server

1. Run the self-extracting hotfix package to extract the hotfix files to a folder on the computer.
2. At a command prompt, type the following command, and then press ENTER:

   osql -S computerName\SHAREPOINTPORTAL -d portal_name1_PROF -n -E -i temporary_folder_path\Sps_migratesids_profdb.sql

   • Replace computerName with the name of the computer.
   • Replace portal_name with the name of your existing portal.
   • Replace temporary_folder_path with the path of the extracted hotfix files.
3. After the query has successfully finished running, type exit, and then press ENTER.
4. Repeat step 2 for the _SITE database. In this case, specify your site database instead of portal_name1_PROF, and run the Sps_migratesids_sitedb.sql query instead of the Sps_migratesids_profdb.sql query.