Why can't I change the identity of this account in Team Foundation Server?

Question

I'm trying to migrate the collections from one Team Foundation Server to another.

A collection that uses local account memberships fails to get attached to the new server. The other collections use domain accounts and get attached without any problem.

So, I identified the accounts with tfsconfig identities

Then, I attempted to change the identities by using the following command:

tfsconfig identities /change /fromdomain:MACHINE_NAME /todomain:DOMAIN_NAME
 /account:LOCAL_ACCOUNT_NAME /toaccount:DOMAIN_ACCOUNT_NAME

But, the operation fails with the following error:

Account Name                      Exists (see note 1)  Matches (see note 2) 
DOMAIN_NAME\DOMAIN_ACCOUNT_NAME   True                 False

0 security identifier(s) (SIDs) were changed in Team Foundation Server.

(1) The Exists column indicates whether the listed account exists in Windows. For the List mode of the command, this is the account stored in Team Foundation Server. For the Change mode, it is the target of the change.

(2) The Matches column indicates whether the SID stored in Team Foundation Server matches with Windows.

When I run tfsconfig identities, I can see both:

MACHINE_NAME\LOCAL_ACCOUNT_NAME       True                 True
DOMAIN_NAME\DOMAIN_ACCOUNT_NAME       True                 True

So, why is it still failing? Any ideas?

Answer 1

The LOCAL\user can't be changed to DOMAIN\user if DOMAIN\user already exists in your TFS instance.

You are effectively getting an "already exists" issue. There is no way to resolve this once you are in this situation as there are a bunch of assets associated with both identity's.

The correct procedure is to follow the "migrating TFS to a new environment" documentation and do a domain migration first. Then move your collection over.

If you can go back to a backup of your collection before you imported it you can resolve it. If not...you can't.