I'm trying to set up FBA on a SharePoint 2013 farm. I am to the point of modifying the security token service web.config file. Here i am using this Technet article.

I am confused about this part:

(replace the following)

  • The distinguished name of your user container in userContainer="OU=UserAccounts,DC=internal,DC=yourcompany,DC=com".
  • The distinguished name of your group container in groupContainer="DC=internal,DC=yourcompany,DC=com".

First of all, I don't have access to the active directory server. So I am trying to gather this information from the SharePoint server, using a tool called ADFind.

Besides that, I'm really confused. I would understand that the first line to be the OU containing all of the users that have access. However, in this client's case they don't have a top level OU. They have a root level, and then a bunch of department OUs under it. How would I set this line?

For the group container line, is this the AD group the machine is in?

Here's what I get using ADFind, edited.

ADFind Results:

adfind -sc u:serviceaccountun dn
dn :CN=username,OU=SrvsAccts,OU=SrvcAccts,DC=domain,DC=com

adfind -sc c:servername dn
dn :CN=SERVERNAME,OU=Servers,DC=domain,DC=com

I'm guessing the group container is this but could be wrong and I'm clueless how to set up the user container one


Any help or direction would be appreciated. Thanks!

1 Answer 1


First off, you do have access to Active Directory. Simply install the Active Directory Users and Computers MMC via Server Manager.

Second, if you want to expose the entire domain, you simply put in:

DC=domain,DC=com for both the Users and Groups.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.