1

One of our SP super user who manage couple site collections recently noticed a behavior where in the people search, she could actually look up using the user email address from the domain forest that I restricted. Moreover, she could share the site, and add the user to the permission group this way.

A little background:

Our company has 3, 4 different domain forests each representing different region of offices. They are:

  • CompanyNA\
  • CompanyEU\
  • CompanyMX\ (for Mexico)
  • CompanyLA\ (Latin America, Brazil, etc)

Both domain are federalized. The SharePoint server I'm managing is only for office users in the North America, so naturally we restricted the user to only the CompanyNA\ domain. I used stsadm with peoplepicker-searchadforests property and it was working as it should.

The interesting part is, if we were to search by name from the other domain forests, the people finder would not return the result. If we were to type in the email address such as user@eu.company.com from other domain forests, it would not return the result. However, if we were to copy and paste "user@eu.company.com" to the people finder, the people finder will spin, and eventually convert it to the account of the user from the CompanyEU\ domain with all the profile info and stuff. Moreover, it seems like the people finder would cache such finding in that super user's computer because even after she has added it, I could not find the EU domain user in my computer, but I could duplicate the issue the same way, and from that point on, the EU domain user would show up in my computer every time I do people finder.

This is a SharePoint 2016 on-premise.

I apologize it's a little lengthy, but I couldn't find anyone else with the similar issue anywhere else.

Much appreciated!

3

This is more or less correct. The browser caches entries that have been used, hence why your user can find it but you cannot.

In addition, SharePoint will first look at the User Info List for entries before making an LDAP call (and ultimately appending data from the UPSA, if available).

Lastly, Search (not People Picker) crawls User Profiles. So if you search for a person, that is where the data originates from -- meaning if that person from a domain that is no longer included in the search scope of domains, they will still be returned by search.

  • Hi Trevor, thanks for the quick reply! From your last point, it sounds like I will also have to restrict the search to certain domain forest to avoid crawler crawling the other domain profiles? – David L. Sep 21 '18 at 19:25
  • You would need to limit the profiles imported via the UPSA. However, if a user from another domain that you're not imported, a profile will be created for them automatically. – Trevor Seward Sep 21 '18 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.