1

Background: I have a SharePoint 2013 server with a dev publishing site. I am trying to set an Audience on several navigation headings and links so I can control what navigation items certain users can see. These link to a mixture of SharePoint pages and custom application pages.

I plan on organizing most users with Active Directory Security Groups (since SharePoint groups can't be nested). I cannot set the Security Group as a member of some SharePoint group because SharePoint doesn't properly detect members of AD Security Groups that are added to SharePoint groups (Audience = SomeSharePointGroup, SomeSharePointGroup contains SomeADGroup, SomeADGroup contains SomeUser. I know this is not how SharePoint audiences work).

So, this means that I need to set the Security Group directly as the audience. However, when I open the People Picker and try to search for a Security Group, I can never get the people picker to find any AD Security Groups.

For the record, I can successfully add AD Security groups to SharePoint groups without incident, but I cannot add the same AD groups as an audience.

What I have tried so far:

  • Confirmed that I am using Security Groups and not Distribution Groups
  • Confirmed that all SharePoint application pools are running as a domain account, and therefore had read-access for AD.
  • Confirmed that the User Profile Synchronization Service is running properly, and that it isn't excluding the groups (I've also found plenty of comments that the UPS/UPSS doesn't have anything to do with the People Picker).
  • Checked the Event Viewer, I can't find any entries in the event viewer caused by the people picker at all.
  • Checked through SharePoint logs to find any mention of an error when I search for a group. The only possibly relevant error is a "DistributedCache" error reporting that it "Failed to get token from distributed cache for ''". This error is always followed by "Reverting to local cache to get token for ''.
  • I have attempted to see if there is a networking issue getting in the way with the following tool: https://github.com/Nauplius/PeoplePickerPortTester/ With it I can properly query AD and i do get a result.
  • I've used PowerShell to get the SPWebApplication and check the PeoplePickerSettings, everything is set to the default values.

So, that's a collection of what I have tried, and at this point I'm at a complete loss. The SharePoint site was even backed up and restored to a new server (with the same patch level), but this issue still persisted.

Does anyone have any advice for where else I could look? I'm going to see if I can update the PeoplePicker-searchadforests property of the people picker through powershell as-if I was setting up cross forest/cross domain queries but only specify the existing AD forest. The only thing I can think of after this is to try and get some support from Microsoft directly...

1

I managed to figure this out with the assistance of Microsoft support. It turns out that this DOES have a dependence on the User Profile Service.

The issue ended up being that the service account for the User Profile Synchronization Service did not have "Replicating Directory Changes" permissions in Active Directory. I didn't notice at first, but whenever I ran a full profile sync it wasn't actually pulling any new information from AD.

After granting the Replicating Directory Changes to my sync service account, I ran a Full Profile Sync in the UPS. After that, I could properly get Security Groups to appear in the People Picker for setting an Audience.

Check your permissions, folks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.