Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote 0 down vote favorite
1

The sharepoint server is setup in the public domain and all service accounts used for installation and configuration are based off of the same(public)domain as well. The server is meant to host the extranet and hence I need the user profiles from the local domain as well. I used the publicDomain\spfarm to obtain all user profiles from the public domain. Now how would I go about doing the same for the users from the local domain? What account would I need to use?Do I need to create a new one? Please note that there is a two way trust between the domains. Thanks

Importing users from company.local domain from a Sharepoint server on the Company's Public Domain

share|improve this question

1 Answer

up vote 1 down vote accepted

If there is a two way trust in place, simply map a connection to that second domain into UPS. In the scenario where there is a two way trust, you don't have to do anything special, simply tell UPS to also synchronize against that second domain. I did have one client that had a two way trust in place, but there was some issue with the Replicating Director Changes role where one of the domains wasn't honoring the trust that our sync account should have that role, and we had to manually grant Replicating Directory Changes on the other domain as well. That said, it was an environment that had many AD issues, that's not a normal requirement. If your sync account has Replicating Directory Changes on one domain, and there's a full trust in place, it should honor it. Note that if you want extranet users to see only extranet profiles then you will want to create a second UPS Service Application that's restricted to only the extranet web application so you can isolate them.

As you have a two way trust, you won't need to do anything special for the people picker either. I'll offer this (Microsoft document) only for future reference. If you have a situation where there's a one way trust, you have to configure the people picker with an account that has the necessary query permissions on that other domain in order for the people picker to be able to search and return users in that domain. Again, only applicable in a one way trust scenario. I also have a blog post that covers some similar people picker issues.

share|improve this answer
Thanks for the input. I ran the sync using my publicDomain\spfarm account that does have replicate directory changes but when I go back in and check (post sync) by entering my Company.local domain It does not return all user profiles and i also did get a lot of "no start credentials" (and an equal amount of succeeds) error while monitoring it on Synchronization service manager. I have appended a picture to my original Question for reference. It would be really heloful if you can suggest me an alternative. Thanks again – user7400 Apr 10 '12 at 11:54
Are they two separate synchronization connections, or somehow combined into a single one? Typically you'd just select the applicable OU(s) from each domain, as opposed to syncing the entire thing. – webdes03 Apr 10 '12 at 13:16
It is one User Profile Service App with two connections. One to sync user profiles from the local domain and the other to pull user profiles from the public domain. – user7400 Apr 10 '12 at 16:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.