"Domain Administrator" user gets access to all subscriptions when migrated from Plesk 9.x to Plesk Onyx

Symptoms

• The migration is performed in 2 steps - from Plesk 9.x to a Plesk Onyx version (e.g. 17.5), and then to another Plesk Onyx version (e.g. 17.8);
• The user with "Domain Administrator" role on Plesk 9.x, which was limited to a single subscription, was migrated with access to all subscriptions on Plesk Onyx.

Cause

This is Plesk Migrator bug with ID PMT-4563 which will be fixed in future extension updates.

Resolution

Currently, there is no workaround available.

In order to remove users with Domain Administrator role, perform the following steps:

1. Connect to the server via SSH/RDP.

2. Create Plesk database backup.

3. Log in to Plesk database.

4. Run the following queries to remove all users with Domain Administrator role from smb_users table and roles attached to them from the smb_roles table:

   MYSQL_LIN: delete from smb_users where login in (select login from (select * from smb_users) AS u join smb_roles as r ON r.id=u.roleId where name like "Domain Administrator%");

   MYSQL_LIN: delete from smb_roles where name like "Domain Administrator%";

5. Remove orphaned records from Plesk database by running plesk repair utility:

   MYSQL_LIN: plesk repair db -y