Attempt to deal with changing login account name issue

Like many companies, we have on a regular basis people who change names due to life situations. I have tried a variety of things to deal with this in SharePoint.

The changes start with the Active Directory admins, who create the user's new login during a night shift. I get an email about the change. When I look in the user profiles, I see that many of the fields for the user reflect the change. However, the actual account name attribute, which is read only to me, never changes during this period.

So this morning, I once again web searched, found http://geekswithblogs.net/rgupta/archive/2011/02/16/change-accountnameloginname-for-a-sharepoint-user-spuser-again.aspx and tried the recommendation.

I ran

stsadm -o migrateuser -oldlogin mydomain\old -newlogin mydomain\new -ignoresidhistory

The user does not exist or is not unique.

PS C:\Users\sa_spfarm>

This is the type of behavior I have gotten over time.

For the longest time I didn't do anything since the user profile was mostly updated. Then an InfoPath programmer reported getting stale information when trying to get the user's login. After research we found that it was using the account name for the user rather than the login attribute (which is properly updated).

Several times I went through adding all the people who had out of date info in their user profile.

I recently tried to write some powershell that would at least produce a report for me of all  users in the farm whose account name differed from their logins - I was never able to get code that actually worked.

Surely there is something simple that I am missing. I am hoping someone reads this who recognizes the problem and lets me know.

The user profile sync is running - new user profiles appear in the system each day and as I said, in all the cases I have seen, the AD information in the profile has all been updated - except the account name (which I suspect must be an index key or something for the profiles).

Thanks!

About the only thing I have seen that works is to go into all dozen or more of our site collections and add the user's new login to an appropriate sharepoint permission group - that seems to force the account name update or at least removes the old entry and creates a new one (I am uncertain which it does).