title: TFS 2012 update failed: Sync error for identity ... No mapping between account names and security IDs was done
body: <p>Upgrading our TFS 2010 to TFS 2012, I get this error on one of the collections:</p>
  
  <p><code>[Error] Sync error for identity: System.Security.Principal.WindowsIdentity, S-1-5-21-xxxxxxx - No mapping between account names and security IDs was done</code></p>
  
  <p>The upgrade fails. Re-running the servicing job from the admin console causes the same error.</p>
  
  <p>I looked in the database, and there is an entry in <code>ADObjects</code> where both <code>SamAccountName</code> and <code>ObjectSID</code> have that SID. It looks like an account from an old domain. <code>fDeleted</code> is 1.</p>
  
  <p>How do I clean this up so I can upgrade?</p>
  
  <p>Added information (from the SQL trace):</p>
  
  <p><code>declare @p3 dbo.typ_ServicingStepDetail2
  insert into @p3 values(1,'ToDev11Beta1FinalConfiguration','BuildToDev11Beta1FinalConfiguration','Grant Administer Build Permissions to Project Administrators','2013-04-12 14:17:55.617',NULL,0,N'Microsoft.TeamFoundation.Framework.Server.IdentitySyncException: Sync error for identity: System.Security.Principal.WindowsIdentity, S-1-5-21-xxxxx - No mapping between account names and security IDs was done
     at Microsoft.TeamFoundation.Framework.Server.TeamFoundationIdentityService.TryReadIdentityFromSourceInternal(TeamFoundationRequestContext requestContext, IdentityDescriptor descriptor, Boolean withDirectMembership, TeamFoundationIdentity&amp; identity)
     at Microsoft.TeamFoundation.Framework.Server.TeamFoundationIdentityService.AddMemberToApplicationGroup(TeamFoundationRequestContext requestContext, IdentityDescriptor groupDescriptor, IdentityDescriptor memberDescriptor, Boolean errorOnDuplicate, Boolean logSync, Boolean ensureKnown)
     at Microsoft.TeamFoundation.Framework.Server.TeamFoundationIdentityService.EnsureIsMember(TeamFoundationRequestContext requestContext, IdentityDescriptor groupDescriptor, IdentityDescriptor descriptor)
     at Microsoft.TeamFoundation.Framework.Server.TeamFoundationSecurityNamespace.EnsureIdentityIsKnownInternal(TeamFoundationRequestContext requestContext, IdentityDescriptor identity, Boolean throwOnFailure)
     at Microsoft.TeamFoundation.Framework.Server.TeamFoundationSecurityNamespace.SetAccessControlEntries(TeamFoundationRequestContext requestContext, String token, IEnumerable</code>1 accessControlEntries, Boolean merge, Boolean throwOnInvalidIdentity)
     at Microsoft.TeamFoundation.Framework.Server.TeamFoundationSecurityNamespace.SetAccessControlEntries(TeamFoundationRequestContext requestContext, String token, IEnumerable`1 accessControlEntries, Boolean merge)
     at Microsoft.TeamFoundation.Server.Servicing.TFCollection.BuildStepPerformer.GrantAdministerPermissionsToProjectAdmins(TeamFoundationRequestContext requestContext, ServicingContext servicingContext)
     at Microsoft.TeamFoundation.Framework.Server.TeamFoundationStepPerformerBase.Microsoft.TeamFoundation.Framework.Server.IStepPerformer.PerformStep(String servicingOperation, String stepType, String stepData, ServicingContext servicingContext)
     at Microsoft.TeamFoundation.Framework.Server.ServicingStepDriver.PerformServicingStep(ServicingStep step, ServicingContext servicingContext, ServicingStepGroup group, ServicingOperation servicingOperation, Int32 stepNumber, Int32 totalSteps)')
  insert into @p3 values(2,'ToDev11Beta1FinalConfiguration','BuildToDev11Beta1FinalConfiguration','Grant Administer Build Permissions to Project Administrators','2013-04-12 14:17:55.617',5,NULL,NULL)</p>
  
  <p>exec prc_AddServicingStepDetails @jobId='xxx',@queueTime='2013-04-12 14:17:50.840',@stepDetails=@p3,@hostId='xxx',@completedStepCount=419`</p>
  
  <p>So it looks like I might have a project administrator who doesn't exist anymore. Any thoughts on how to remove that membership manually?</p>