In our environment there is two domains: Domain.com & Test.com. The SharePoint 2013 on-premise farm is installed on Domain.com. We found the people picker can only query users under Domain.com. To resolve it we ran the stsadm command:

stsadm -o setproperty -pn peoplepicker-searchadforests -pv "forest:ad.Domain.com;forest:test.ad.Domain.com,test\farmadmin,Password" -url http://webapp

The comamnd completede successfully. Right after the command completed, all people picker return nothing. Not even the users under Domain.com. I think the passwords are valid.

Later I reset the property back to original status which is nothing:

STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv "" -url http://webapp

Then the peoplepicker back to original status. (Can search users under Domain.com but not for Test.com) How can I troubleshoot it?

P.S. Before I run above command, I have run this:

stsadm.exe -o setapppassword -password 123456

Is the 123456 matter? I think it is just a passphrase. Also I only have single server for both WFE and APP. Another server for SQL. Do I need to run the setapppassword at SQL server?

1 Answer 1


It is because the application pool account have no access to the passphrase I setup using "stsadm -o setapppassword".

To solve it, use regedit to modify the permission of "HKEY_Local_Machine\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\Secure\". Grant read permission to local WSS_WPG group.

refer: http://blogs.msdn.com/b/jorman/archive/2011/02/16/people-picker-why-don-t-you-trust-me.aspx?CommentPosted=true#commentmessage

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.