3

Given lack of centrally managed infrastructure in the past when our company first started, our office has 4 different AD domains through out the Pan-America region. We've been trying to centralize these domains but there won't be any immediate result anytime soon.

Our on-prem 2016 servers will take all 4 domains logins because they are federalized. Is there anyway to restrict user logon to just one certain domain? The problem I'm seeing is user supposed to use their central domain AD account to login, but instead, they use they local office domain to login, which creates user access request to the site administrators when these users already have access using their central domain account. I know how to limit the people picker to search only certain domain, but it does not restrict the domain logins.

Much appreciated!

Improve this question
3
  • What type of trust you have between your domains?
    – Marek Sarad
    Mar 14, 2018 at 9:00
  • Hi Marek, speaking with the infra engineer he thinks it's two way trust, but it was setup before his time so he'd have to check. Thanks for the feedback!
    – David L.
    Mar 14, 2018 at 16:13
  • I have another idea. But this only would work if SharePoint resides in the "Central Domain". Is this the case?
    – MHeld
    Mar 15, 2018 at 13:43

1 Answer 1

Reset to default
0

As you have a trust between domains, you are not able to limit SharePoint to your "Central Domain". Even if SharePoint would provide such a setting, what error message do you expect? Would that really decrease the number of Support-Requests than today's "access denied" message?

My Idea to work around this problem is implementing ADFS and WebApplicationProxy via Kerberos. This is something like an external deployment of SharePoint inside your organization. You could then add a default domain to the ADFS-Login-screen. Maybe this solution is not perfect for you, but you can experiment with the WAP/ADFS login options to get a suitable scenario for your exact needs.

Improve this answer
2
  • Hi Mheld, I think you got it, it's really just to decrease the number of support-request. I haven't test it but I think these users' computer are logged in to the local office domain, so when they visit the sharepoint site, the computer tries to log them in using windows logon. Or perhaps I'm wrong, because SharePoint would still pop up a logon window asking them to input the user credentials. For your idea, I'll discuss this with the infra. engineers, I feel like it may be too much work without much ROI in time spent. But we'll play with the idea, thanks!
    – David L.
    Mar 14, 2018 at 16:17
  • Maybe your users get authenticated automatically via SingleSignOn with their "local Doman" user. So the user didn't do anything wrong. This behavior is controlled by adding SharePoint to the "Local Intranet Zone" in IE-Security Settings. If you do not have a FQDN (http://sharepoint), this site will automatically be seen as local intranet and SSO is performed. More Details here: blogs.msdn.microsoft.com/ieinternals/2012/06/05/…. Getting rid of SSO might be an easy answer for you instead of ADFS. An ADFS-Login-Page is still much sweeter than a Windows-Logon-Screen :)
    – MHeld
    Mar 15, 2018 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.