How can I diagnose or resolve missing AD groups for target audience rules

Question

Hello everyone,
I'm having some problems with the target audiences I have set up in my SharePoint 2010 farm. I have set up a single rule for each target audience in Central Administration, pointing to a group in Active Directory. Up until a couple of weeks ago I had no
problem using the people picker to look up AD grups and everything seemed to be working, but now I am suddenly not able to find any groups in AD.
The User Profile Synchronisation is running without any errors. I have already performed a full synchronisation and compiled all audiences with no luck. I have also checked the property called peoplepicker-searchadforests with stsadm and that appears to
be correct as well. If I try and look up the same AD group in a peoplepicker on one of the site collections it is immediately displayed with no errors. All of the AD groups I'm using are global security groups and the ULS log contains no errors from when the
target audience compilation started until it ended.
What puzzles me is that AD groups on our test environment can be found in the peoplepicker in Central Administration without any problems, despite the fact that the target audience rule fails with the message "Non-existent Membership group...".
It would seem to me that SharePoint does not look up the security groups directly in AD but rather somewhere else - a lot of posts suggests that SharePoint stores information about target audience it in the ProfileDB but I haven't been able to find which table.
I know I'm leaving out a lot of other details but what I really need to know is how I can investigate this issue further, e.g. does SharePoint in fact look up the groups in the ProfileDB and if so from what table? Is there any kind of tool or technique I
can use to actually see what happens in SharePoint from the moment I try and search for an AD group in the people picker?

Answer 1

Hi SharePointMC,
Thank you for the info - I didn't know about $wa.PeoplePickerSettings :-)
I have compared all the properties from PeoplePickerSettings between our prod- and test environment and the only difference I found was that the domain was added to "distributionlistsearchdomains" on prod but not on test. Adding the value in test did not
reproduce the issue though.
I'm not sure if I can see somewhere which account was used to set up the people picker but the account I used to look up AD-groups is not locked out and there is no filter set for peoplepicker-searchadcustomfilter. If there is a way to see which account
was used to set up the people picker I would very much like to know.
However I did manage to find some clue in the profile database. It turns out that querying the MemberGroup table I was able to locate all target audiences on our test environment (not counting the "all site users"), but I was not able to find any of the
groups in prod. If the peoplepicker is indeed looking for the AD groups in ProfileDB then that might explain why I cannot find any groups.
The question is how I can persue this further - how does SharePoint update the Profile database and what would be a good place to look for any errors?