Hello
I upgraded one of my SharePoint sites from 2010 to 2013 last night and converted it to claims mode using the  Convert-SPWebApplicationcommand with the -RetainPermissions switch.

However, once I logged into the 2013 upgrade environment I found that my users could not log into the site.  I had to add the user group back in and then once I did that the users could get access to the site however the individual users could not get access to the libraries that they did have access to previously.  I had to readd the permissions using their domain credentials (domain\username) as when I selected them from the people picker it wouldn't add to the site properly.  Now when I look in my list of users in the collection I have some double ups.  Also when I select users from the people picker there are double ups.  I noticed that some of the users dont have the i:0#.w| in front of their user names.  These are typically the users I cannot add to permissions for the libraries.

Finally, if I look at the user information for a user it comes up with 'sorry, something went wrong'.  again, its looking for the users that no longer exist in the site collection.

Is there a way I can cleanly fix this?

Hi Martin,

As your description, there are some issues when the users access the sites upgrated to SharePoint 2013.

When you converted the web application to claims mode, do you migrate users?

Please run the following cmdlets to migrate users:

$wa = get-SPWebApplication $WebAppName
$wa.MigrateUsers($true)

More information about migrating from classic-mode to claims-based authentication in SharePoint 2013:

https://technet.microsoft.com/en-us/library/gg251985.aspx

A similar post for your reference:

https://social.technet.microsoft.com/Forums/sharepoint/en-US/009d6078-e94a-4c10-9e43-03e13e95f05b/after-migrating-sharepoint-2010-to-2013-users-cant-log-in?forum=sharepointgeneral

Thanks,

Wendy

How did you migrate?

Convert SP2010 Classic to SP 2010 Claims then migrate to 2013.

If this is the case run this in 2010 server for conversion

$WebAppName = "http://<yourWebAppUrl>"
$wa = get-SPWebApplication $WebAppName
$wa.UseClaimsAuthentication = $true
$wa.Update()
$wa.MigrateUsers($true)
$wa.ProvisionGlobally()
Migrate SP2010 classic to SP2013 Classic and then convert to claims
Then do this way in 2013 server for conversion
Convert-SPWebApplication -Identity <yourWebAppUrl> -From Legacy -To Claims  -RetainPermissions [ -Force]
		

I converted by creating the web app in SP2013 and then mounting and upgrading the SP2010 content database.  Once this was done I typed in the following command:

Convert-SPWebApplication -Identity <yourWebAppUrl> -From Legacy -To Claims  -RetainPermissions

Once I did this the web app did report a number of user errors and I could log in with my admin user but not with the actual site users. I ended up having to enter the users in again manually.

I didn't type in this command - was I meant to do that after doing the upgrade?

$wa = get-SPWebApplication $WebAppName
$wa.MigrateUsers($true)

Hi Martin,

When you created the new web application, are you using Classic mode or Claims based authentication?

The reason of some users don't have the i:0#.w| in front of their user names is that they are not using Claims Based authentication. So, I suggest you migrate users via PowerShell command.

Thanks,

Wendy

When I created the web apps in the 2013 environment I use claims type with integrated Windows authentication with NTLM.  I don't tick the Forms based authentication option.

When you say that I migrate the users via powershell, is that this one here and can I do this after the site is live?

$wa = get-SPWebApplication $WebAppName
$wa.MigrateUsers($true)

Actually, I migrated another 2010 web app to 2013 yesterday and I ran the above migrate users command it migrated fine however there was one user that wasn't migrated to claims because she wasn't in active directory as a user anymore.  is this normal?

Thanks

You should create web application in 2013 using powershell to create classic web application (UI does not create classis web application , it creates only claims), then move database from 2010 to 2013 and upgrade it, then run following command 

Convert-SPWebApplication -Identity <yourWebAppUrl> -From Legacy -To Claims  -RetainPermissions [ -Force]

Hi Sachin,

Thanks for your reply.  Do you have the powershell script to create a classic web application ?

I assume then after this you convert the users to claims after converting the app?

THanks

Use following link:

https://technet.microsoft.com/en-us/library/gg276326.aspx?f=255&MSPPError=-2147217396

New-SPWebApplication -Name "Contoso Internet Site" -ApplicationPool "ContosoAppPool" -AuthenticationMethod "Kerberos" -ApplicationPoolAccount (Get-SPManagedAccount "CONTOSO\jdoe") -Port 80 -URL "https://www.contoso.com"