One of our SP super user who manage couple site collections recently noticed a behavior where in the people search, she could actually look up using the user email address from the domain forest that I restricted. Moreover, she could share the site, and add the user to the permission group this way.
A little background:
Our company has 3, 4 different domain forests each representing different region of offices. They are:
- CompanyNA\
- CompanyEU\
- CompanyMX\ (for Mexico)
- CompanyLA\ (Latin America, Brazil, etc)
Both domain are federalized. The SharePoint server I'm managing is only for office users in the North America, so naturally we restricted the user to only the CompanyNA\ domain. I used stsadm with peoplepicker-searchadforests property and it was working as it should.
The interesting part is, if we were to search by name from the other domain forests, the people finder would not return the result. If we were to type in the email address such as [email protected] from other domain forests, it would not return the result. However, if we were to copy and paste "[email protected]" to the people finder, the people finder will spin, and eventually convert it to the account of the user from the CompanyEU\ domain with all the profile info and stuff. Moreover, it seems like the people finder would cache such finding in that super user's computer because even after she has added it, I could not find the EU domain user in my computer, but I could duplicate the issue the same way, and from that point on, the EU domain user would show up in my computer every time I do people finder.
This is a SharePoint 2016 on-premise.
I apologize it's a little lengthy, but I couldn't find anyone else with the similar issue anywhere else.
Much appreciated!
