0

We have a webapplication http://webapp1 installed in domain contoso1.

We also have contoso2 domain . contoso1 and contoso2 has bidirectional trust.

I have executed below script against webapp

stsadm -o setproperty -url  "http://webapp1" -pn peoplepicker-searchadforests -pv "forest:Contoso1.com;forest:Contoso2.com;"

And done IISRESET.

Still I cannot get users from contoso2 in people picker from webapp1 sites.

What can be the troubleshooting steps here?

Update: This can be irrelevant but I am syncing user profile successfully from both these domains.

Update2 : I am getting below error in Logs, while entering user name in people picker

Error in searching user 'User Name' : System.Runtime.InteropServices.COMException (0x8007052E): The user name or password is incorrect.
Improve this question

2 Answers 2

Reset to default
1

I found an article at blogs.microsoft.com that may help you

Click here to see the article

In order to instruct SharePoint to query those trusted domain or forests we need to configure access to them by using the Stsadm command-line tool and selecting an account to use when accessing each forest or domain. Those credentials must be from the forest/domain to be queried or from a trusted domain, as long as it is allowed to authenticate and is not denied to logon remotely.

You can use a different account for each target domain or forest, or the same account for all domains and forests.

On every front-end Web server on a farm, at a command prompt, type the following command, and then press ENTER:

STSADM.exe -o setapppassword -password key

Note: The account and password used to access each domain or forest is stored on each front-end Web server in the farm . This key is an encryption string that is used to encrypt the password for the account that is used to access the forest or domain . This encryption string must be the same for all servers in the farm, and unique for each server farm in a deployment with multiple farms.

On a front-end Web server, at a command prompt, type the following command, and then press ENTER

STSADM.exe -o setproperty-propertyname peoplepicker-searchadforests -propertyvalue <Valid list of forests or domains> -url <URL of the Web application>

Note : You have to provide a valid list of forest/domains to be queried as well as the credentials to do so, this can be specified as below .

forest:DnsName,LoginName,Password

domain:DnsName,LoginName,Password

You can add multiple forests and or domains by listing multiple domains or forests in the format Forest/Domain:DnsName,LoginName,Password separated by semicolons. For e.g.

STSADM.exe -o setproperty-propertyname peoplepicker-searchadforests -propertyvalue "forest:Contoso.com,Contoso\User1,PasswordofUser1; domain:Fabrikam.com,Fabrikam\User2,PasswordofUser2" -url http://webapp

Note : You can omit the username and password if the application pool identity already has access to Target domain or forest, this would be the case where application pool identity is from the Trusted forest or domain itself .

Improve this answer
4
  • Yes, I have followed exact same thing, but users are not reflecting in people picker.
    – Rohit
    Commented Nov 3, 2015 at 12:16
  • does your apppool service user has min. read permissions on both forest/domains ?
    – ReTech
    Commented Nov 3, 2015 at 14:27
  • how do I check it? I think yes. Any way to verify?
    – Rohit
    Commented Nov 4, 2015 at 8:05
  • rightclick the forest in "Active Directory Users and Computers" --> Properies--> "Security" tab --> check if the user is listed, or is member of a group which is listed there.
    – ReTech
    Commented Nov 4, 2015 at 13:57
0

Did you try with "domain" rather than forest?

you can also try this, just to control.

STSADM.exe -o getproperty -pn peoplepicker-searchadforests -url http://webapp1
Improve this answer
4
  • What will be the command with Domain?....running above command gives me this output ==> <Property Exist="Yes" Value="forest:contoso1.com;forest:contoso2.com" />
    – Rohit
    Commented Nov 3, 2015 at 8:48
  • STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv "domain:aaa.com;domain:bbb.com;" -url webappurl
    – Seb
    Commented Nov 3, 2015 at 9:23
  • No luck. did IISRESET as well. Is there a way to check logs or something to check whats blocking it.
    – Rohit
    Commented Nov 3, 2015 at 9:53
  • You may find hints here
    – Seb
    Commented Nov 3, 2015 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.