Background: I have a SharePoint 2013 server with a dev publishing site. I am trying to set an Audience on several navigation headings and links so I can control what navigation items certain users can see. These link to a mixture of SharePoint pages and custom application pages.
I plan on organizing most users with Active Directory Security Groups (since SharePoint groups can't be nested). I cannot set the Security Group as a member of some SharePoint group because SharePoint doesn't properly detect members of AD Security Groups that are added to SharePoint groups (Audience = SomeSharePointGroup, SomeSharePointGroup contains SomeADGroup, SomeADGroup contains SomeUser. I know this is not how SharePoint audiences work).
So, this means that I need to set the Security Group directly as the audience. However, when I open the People Picker and try to search for a Security Group, I can never get the people picker to find any AD Security Groups.
For the record, I can successfully add AD Security groups to SharePoint groups without incident, but I cannot add the same AD groups as an audience.
What I have tried so far:
- Confirmed that I am using Security Groups and not Distribution Groups
- Confirmed that all SharePoint application pools are running as a domain account, and therefore had read-access for AD.
- Confirmed that the User Profile Synchronization Service is running properly, and that it isn't excluding the groups (I've also found plenty of comments that the UPS/UPSS doesn't have anything to do with the People Picker).
- Checked the Event Viewer, I can't find any entries in the event viewer caused by the people picker at all.
- Checked through SharePoint logs to find any mention of an error when I search for a group. The only possibly relevant error is a "DistributedCache" error reporting that it "Failed to get token from distributed cache for ''". This error is always followed by "Reverting to local cache to get token for ''.
- I have attempted to see if there is a networking issue getting in the way with the following tool: https://github.com/Nauplius/PeoplePickerPortTester/ With it I can properly query AD and i do get a result.
- I've used PowerShell to get the SPWebApplication and check the PeoplePickerSettings, everything is set to the default values.
So, that's a collection of what I have tried, and at this point I'm at a complete loss. The SharePoint site was even backed up and restored to a new server (with the same patch level), but this issue still persisted.
Does anyone have any advice for where else I could look? I'm going to see if I can update the PeoplePicker-searchadforests property of the people picker through powershell as-if I was setting up cross forest/cross domain queries but only specify the existing AD forest. The only thing I can think of after this is to try and get some support from Microsoft directly...
