Can no longer add users!!!

[emorisset]

OK, this is a weird one...

I have a sharepoint site that had been up and operational for nearly a year and for some reason I can no longer add new users to the site...

The basic layout of the site is the home page, then links to several sub-sites (HR, finance, technology, etc). Each sub-site has access granted by its own adminstrator (don't want everyone to snoop through the Finance stuff!). The users are added via the 'Manage Users' section of each sub-site. The admin just uses the domain\user information in Active Directory, gives the appropriate permissions, and the clicks 'finish' to complete the process. This has worked perfectly until last week...

A sub-site admin reported that after adding the domain\user information, sharepoint retrieves the user information (Display Name, email address) stored in Active Directory, but after hitting the 'finish' button, now gets and error stating 'The user does not exist'. The user has to exist because Sharepoint returns the information contained in Active Directory! Weird...

Now I can not add users to any of the sub-sites, or even the home page!!! I deleted users, (thinking perhaps some sort of threshold was reached) but can not add them back (or other users in their place). I just can no longer add users to the site...

I rebooted the server, that didn't help. I also noticed that I can no longer adjust the site group memberships for those users already in the site.

I have looked all over the Microsoft site (and searched in Google as well) without any luck...

Any help will be GREATLY appreciated. Thanks.

 

[Thomas2000]

Hi,

This sounds like a tough one. Are you getting any other errors in Event logs or SharePoint logs?

Are you running SharePoint Portal Server or Windows SharePoint Services?

I have noticed that if a user has been deleted, and then you add the same user again, sharepoint does not necesarily fetch all the information from Active directory (atleast it does not appear to be so). I had a user that had his usernamned changed and when adding him with the new one domain\username, sharepoint automatically added him with his old account and I had to clean out "remains" of the account on several places in sharepoint.

Have you had any changes done to the A.D lately? The account you use in sharepoint (for administrative purposes, running services etc) does it has read rights to your A.D?

What kind of errors do you get when you try to change the sitegroup membership of a user?

Regards,
Thomas

 

[emorisset]

Thomas,

Thanks for taking a crack at this one.

We are running Shapoint Portal Services on a 2003 Server installation. Sharepoint SP1 is NOT installed, but I don't think that is the problem.

I have tried dozens of user accounts, in different sub-sites, no luck. Changing the site groups for the current users results in the same 'the user does not exist' error.

BUT, in our environment, we currently have multiple domains (I'll call them A, B, C, D) with Trusts established. I am able to add users from the B, C, D domains, but not the A domain. Of course, the vast majority of the users reside in the A domain. Because of this, I had the Active Directory Server for the A domain rebooted but that didn't help.

Because of this, I believe that Sharepoint is fine. If there was a problem in Sharepoint, then I would not be able to add users from any of our domains. I do not know if the WAN group has made any changes (and I will kill them if they did) but that seems to me the most likely culprit at this time.

If anyone has any insight on what network changes can force this error (while still allowing LDAP queries into Active Directory) please let me know. Also, if you could let me know if my hypothesis makes sense, it would be appreciated.

Thanks,
Eric

 

[Thomas2000]

Hello,

I would agree with you that the problem is not sharepoint it sounds like a network communication problem and also user-rights problem. And since you can add users from domain B, C and D, then it makes sense to investigate the trust and communication, user righs management with the A domain.

If there are firewalls between the domains, it might be a good idea to look in the logs and see if anything is being denied there aswell. Also checking if there are any other log files that might give you any messages.

Since you get the error user does not exists, to me it sure sounds like you do not have any contact with the A domain (or correct rights to be able to read from it, and that can be caused by a trust not working properly aswell).

Regards,
Thomas