4

I've been dealing with SharePoint 2013 OOTB People Picker for a while. My environment has SharePoint 2013 and an one-way trusted domain controller that provides end users account. People Picker can query user account in the trusted domain after I ran peoplepicker-searchadforests. The trusted domain contains a number of different agencies with this hierarchy: OU=Agencies,OU=,OU=User Acounts,DC=contoso,DC=com. If there is no limit configured on People Picker, it can query any users in any agencies in the domain.

The requirement to reduce information leakage is to limit OU so People Picker can only search in a specific OU. I've ran several commands to limit People Picker but can't seem to make it work so far.

  • Set-SPSite -Identity http://sharepoint2013 -UserAccountDirectoryPath "OU=Agencies,OU=XYZ,OU=User Acounts,DC=contoso,DC=com"
  • stsadm -o setproperty -url http://contoso -pn "peoplepicker-searchadcustomfilter -pv "(|(memberof=OU=OU=Agencies,OU=XYZ,OU=User Acounts,DC=contoso,DC=com))

People Picker just can still query a few users. What is also strange to me is if I set the path as SearchActiveDirectoryDomains property value (DC=contoso,DC=com), People Picker will result as it does after these above commands run.

WireShark, Microsoft Message Analyzer and Network Monitor have been used but there is no LDAP traffic captured so far. It makes me to come up with this topic to learn more about SharePoint 2013 People Picker behind the scene.

Your suggestion would be greatly appreciated.

Improve this question

1 Answer 1

Reset to default
0

By default, the GC service is used (port 3268-3269) to query the DCs.

When working with external forest/domains, things start to get a little different.

I suggest reading the following 2 articles about the subject:

http://blogs.msdn.com/b/rajank/archive/2009/09/01/all-you-want-to-know-about-people-picker-in-sharepoint-functionality-configuration-troubleshooting-part-1.aspx

http://blogs.msdn.com/b/rajank/archive/2009/09/20/all-you-want-to-know-about-people-picker-in-sharepoint-functionality-configuration-troubleshooting-part-2.aspx

Improve this answer
1
  • Thank you Tom. I already read your recommended articles. IMO it's applicable for SP2010. The People Picker in SP2013 would be a little different in LDAP query. I also captured LDAP protocol (whatever port it uses) on Microsoft Message Analyzer, Network Monitor but no luck.
    – EagleDev
    Apr 2, 2015 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.