SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have two different domains A.LOCAL and B.LOCAL. There is a one way trust configured and SP2010 is installed on B.LOCAL. I want to be able to pick accounts from both A and B. I am able to get the people picker to work exactly how I want when I use A\ADomainAdmin but if I use A\AUser it doesn't resolve anyone from A.


stsadm -o setproperty -pn peoplepicker-searchadforests -pv "forest:A.LOCAL,A\ADomainAdmin,Pa$$word;domain:B.LOCAL,B\BUser,Pa$$word" -url

Doesn't Work:

stsadm -o setproperty -pn peoplepicker-searchadforests -pv "forest:A.LOCAL,A\AUser,Pa$$word;domain:B.LOCAL,B\BUser,Pa$$word" -url

Using a Domain Admin account for A is not a long term solution. What are the minimum rights for peoplepicker-searchadforests to resolve cross domain?

share|improve this question
up vote 1 down vote accepted

The only permission you should require is the "list contents" right. By default the domain user group has this permission.

Did you configure the encryption key?

Technet has a post on PP issues:

share|improve this answer
Yes, the key has been configured. It looks like our organization does not allow "list contents" for normal domain users. I will see if this resolves my issue once the right is granted. – RyanHirsch Aug 24 '11 at 18:31
Yes, this worked, thank you so much! – RyanHirsch Sep 1 '11 at 16:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.