3

I am using Audiences to display either UK or US links on our Sharepoint portal. It has worked fine for years, but lately new starters are not able to see the links on the portal. If a user is in the UK Audience normally they can see the links that are for UK sites.

In the picture below, you'll see a value of UK Users (an Active Directory group) that is used for the UK Audience. As you would expect, if a user is in the UK Users AD group, they can see content for the UK Audience.

However, for new starters using the AD group no longer works! I don't know why. Instead I am having to create an additional rule Account = username. I might run out of additional rules at some point!

I don't know if it is relevant, but the AD group has exactly 150 people, a few of whom can not see the UK Audience links.

Here is a screen shot from Central Administration on the server:

Pic of Audiences menu from server

Research

Post with a similar issue: see question. Although compiling the Audience does not resolve the issue.

This post refers to User Profile Synchronisation and AD groups that don't show up. Not my issue...my AD group does show up, but does not work for new members.

Another similar(ish) post: here. Although I am not setting up a new Audience, there was an established process which worked until recently.

23 Oct 2018 - Extra Research, could be of use to other users:

I've not resolved my issue yet, but given the suggestions of other fine SP SE persons, I've found a couple of potentially useful links:

  1. User profile synchronization service failures

  2. Maintain user profile synchronization settings in SharePoint Server 2013

Edit: Info from my IT Dept regarding User Profile Sync

I asked IT to verify whether the AD-SP sync worked. They say: "User Profile Service Synchronisation is running correctly in sharepoint, and we can see that the users in question do have a profile, otherwise they would not have been able to even login to sharepoint. So I think we can rule this out as the reason they are not appearing in the correct audience".

Improve this question
6
  • 1
    hi Tally, per your link the last post you referenced, are you able to verify that the service account running UPS still has Replicate Directory Changes? Or if that account has been modified in any other way (though this would also likely result in broader User Profile Sync issues - which it sounds like are not occuring?). – Drew Paxton Oct 16 '18 at 16:28
  • You need to work with your infrastructure people. Compilation is process that involves AD and you need to see do you get any errors on that side when you sync/compile. – Marek Sarad Oct 17 '18 at 12:10
  • @Marek - thanks for the response. I've updated my post with an 'Edit' section regarding AD->SP sync/Compilation – Tally Oct 19 '18 at 7:38
  • "otherwise they would not have been able to even login to sharepoint." this is not correct you can run sharepoint farm without the UPS. I still think you should review the DC logs from the time of sync. – Marek Sarad Oct 19 '18 at 14:20
  • @Tally You could refer to my answer as it was the only solution of the same issue i faced earlier. – Sohail Shaikh Oct 19 '18 at 16:45
1
+100

I faced the same issue Cannot set the accessibility of navigation tabs through AD groups few months back.

Solution: Grant Replicating Directory Changes Permission in the AD to the account used for synchronization of user profile service.

Improve this answer
2
  • Hi Sohail, I've investigated this with our IT but it doesn't appear to be the issue for me. I left a comment to Drew, which applies here too. We're left wondering if there is a hard limit of 150 AD members, though it could just be coincidental that it stopped working at this point. We're going to try testing with a new AD group (UK Users2) to test this theory, with the idea that it'll give us another 150 users. The UK Users2 AD group will be configured to see the same SP links as the original UK Users Audience. I'll award the bounty, since this was a helpful investigative idea. – Tally Oct 23 '18 at 8:37
  • @Tally I'm not sure about limitation of AD members, please do let us know if the issue was related to AD members limits. However, in my case I'm sure that the no. of user profiles in USP was around 4-5K and it solved after granting replicating directory changes permission (no. of user profiles increased after applying this fix and synchronizing). Thanks for the bounty though :) – Sohail Shaikh Oct 24 '18 at 16:59
0

You might need to perform user profile sync again. Verify if there were any errors in previous incremental crawl. If not perform a full user profile sync. After successful sync you can then compile the audience.

Improve this answer
3
  • Thanks sssreddy for the Answer. My IT dept investigated this and were satisfied that this was not the issue for us. Do you have a link to the 'full user profile sync' by any chance? It sounds like this is something done in AD, do you have a link to some guidance on this? I found a few useful looking links, which I'll add to my Question under Research, in case it can be useful to others. – Tally Oct 23 '18 at 8:46
  • 1
    I meant running a user profile sync on SharePoint. There are two syncs, full sync and incremental sync. Have you tried running a full sync of user profiles. It is my understanding that you might need a full sync for SharePoint to pull down group membership. I found a blog here at blog.arjanfraaij.com/2011/05/… which seems to mention the same (see end of the article). – sssreddy Oct 24 '18 at 14:11
  • That's really a good find, thanks, lots of pictures to cross-check against my own system. The blogger was working through configuring the User Profile Service Application, I found his preceding post on configuring the Profile Synchronisation Application Service - I think I have lost some settings here. Since I tried doing the 'full user profile sync' and nothing happened! So...thank you for helping to pinpoint where the problem is! Not fixed yet, but I'll post on it later. – Tally Oct 25 '18 at 9:24
0

AD groups and Sharepoint groups are different. You may need to have separate sharepoint group for UK users & US users which will basically have all values included in their corresponding AD groups. I think you're using Sharepoint 2013 so you will need to sync these groups

Improve this answer
3
  • Hi akg, thanks for the post. We are using the set-up you describe, there is a UK Users group in AD, which is used for the membership of the UK Audience. I've added a paragraph regarding User Profile Sync (aka Compilation). – Tally Oct 19 '18 at 7:40
  • @Tally Sharepoint groups and O365 groups(security groups which contain user profiles etc) are different. If you need to add group permissions you'll require a sharepoint group and not a group from AD. Get it? Try this, go to main site mysharepoint.com > site setting > user permissions/site permissions... there create a new user group and add in the AD group there. Then when you're to give permission use the Sharepoint group which you created instead of the AD group. – akg1421 Oct 19 '18 at 7:47
  • 1
    @akg1421 Tally is using audiences not permission different concept in SP. – Marek Sarad Oct 19 '18 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.