One of my customers has a second Sharepoint farm installed in the extranet network with a dedicated domain. To allow internal users to login in the extranet Sharepoint, there is a one-way trust between internal domain and external domain.

I'm trying to add internal's users in a site collection of extranet's farm, but I got this error


$web = Get-SPWeb http://extranet/sites/sitecollection

Exception calling "EnsureUser" with "1" argument(s): "The specified user i:0#.w|internalDomain\userName could not be found."
At line:1 char:1
+ $web.EnsureUser("i:0#.w|internalDomain\userName")
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : SPException

EDIT Even if ensureUser doesn't work, the authentication process for that user works normally.If I grant collaboration permissions to group "all users authenticated", that user access to the home page.If that user adds an element to a list the field Author is empty

EDIT Thanks Marek Sarad, I have fixed it.

I run the powershell script for Sharepoint 2016 but it didn't work, it throws an error on the line

Exception calling "SetPassword" with "1" argument(s): "Cannot retrieve the information for application credential key."

To fix it, I run the command STSADM -o setapppassword -password myPassword then I had another problem. in the Sharepoint website, I installed a custom HTTP module that throws an error on SPWeb.EnsureUser

Application error when access UrlToDocument, Error=Requested registry access is not allowed.  
 at System.ThrowHelper.ThrowSecurityException(ExceptionResource resource)    
 at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable)    
 at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipalInternal(SPWeb web, SPWebApplication webApp, Nullable`1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, SPUserCollection usersContainer, Boolean inputIsEmailOnly, Boolean alwaysAddWindowsResolver)    
 at Microsoft.SharePoint.SPWeb.EnsureUser(String logonName)    
 at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()    
 at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)    
 at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

I used procmon.exe and I saw that the application pool user cannot access to the registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\Secure

because it haven't the permissions. I grant that account to read that registry key. what do you think about it? do you suggest to change the code of the http module to use some magic c# feature to impersonate an administrator security context?

1 Answer 1


Can you add users using people picker from the UI? If not probably you haven't configured it properly. In a one way scenario you need to run specific command:

stsadm -o setproperty -url http://<server:port> -pn peoplepicker-searchadforests -pv "forest:contoso.corp.com, contoso\<account>, <Password>;domain:bar.contoso.corp.com, contoso\<account>, <Password>"

REF: https://support.microsoft.com/en-us/help/2384424/sharepoint-people-picker-stops-resolving-users-from-other-domains-with

or PS version if you are on SP2016: https://blogs.msdn.microsoft.com/odabasi/2015/10/22/configuring-people-picker-in-a-one-way-trust-environment-with-powershell/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.