I've been dealing with SharePoint 2013 OOTB People Picker for a while. My environment has SharePoint 2013 and an one-way trusted domain controller that provides end users account. People Picker can query user account in the trusted domain after I ran peoplepicker-searchadforests. The trusted domain contains a number of different agencies with this hierarchy: OU=Agencies,OU=,OU=User Acounts,DC=contoso,DC=com. If there is no limit configured on People Picker, it can query any users in any agencies in the domain.
The requirement to reduce information leakage is to limit OU so People Picker can only search in a specific OU. I've ran several commands to limit People Picker but can't seem to make it work so far.
- Set-SPSite -Identity http://sharepoint2013 -UserAccountDirectoryPath "OU=Agencies,OU=XYZ,OU=User Acounts,DC=contoso,DC=com"
- stsadm -o setproperty -url http://contoso -pn "peoplepicker-searchadcustomfilter -pv "(|(memberof=OU=OU=Agencies,OU=XYZ,OU=User Acounts,DC=contoso,DC=com))
People Picker just can still query a few users. What is also strange to me is if I set the path as SearchActiveDirectoryDomains property value (DC=contoso,DC=com), People Picker will result as it does after these above commands run.
WireShark, Microsoft Message Analyzer and Network Monitor have been used but there is no LDAP traffic captured so far. It makes me to come up with this topic to learn more about SharePoint 2013 People Picker behind the scene.
Your suggestion would be greatly appreciated.