PeoplePicker-SearchADForests not limiting to specified forest domains

We have a SharePoint 2010 farm and we have 3 forests with a few domains in each. Initially, we had PeoplePicker-SearchADForests setting set as below.
<Property Exist="Yes" Value="forest:compX.com;forest:compY.com;forest:compZ.local" />
We want to limit users search to certain domains in 2 of the 3 forests, so we set it as below for all the web applications.
<Property Exist="Yes" Value="domain:domain1.compY.com;domain:domain2.compZ.local" />
The problem is that when I go to People Picker search for users, it still returns users from the 3rd forest - compX.com, if I enter the domain name and click Search button. Actually, I can get all users from all forests as if the setting doesn't work at
all.
Any idea why this happens?

Hi,
According to your description, my understanding is that you want to limit the people picker to search specified domains.
Which command did you use to set the limitation on people picker?
I recommend to use the command below(for example) to restrict the people picker for specific domains to see if the issue still occurs:
STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv "domain:aaa.com;domain:bbb.com;domain:ccc.com;domain:ddd.com" -url
http://webappurl
More references:
http://blogs.msdn.com/b/svarukala/archive/2014/03/26/issue-with-peoplepicker-searchadforests-stsadm.aspx
http://blog.ithinksharepoint.com/2008/10/30/restricting-the-people-picker-to-searching-one-domain/
http://technet.microsoft.com/en-us/library/cc263460(v=office.12).aspx
Thanks,
Victoria
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Victoria Xia
TechNet Community Support

Similar Messages

Error: A user with the specified SID could not be found in the domain.

Hi All,
I am getting a error as below,
A user with the specified SID could not be found in the domain.
Check the spelling of the account name 'domain\usersAMAccountName' and try again.
-    at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.GetSidFromAccount(String strAccountName, SID_NAME_USE[] IntendedAccountType, SID_NAME_USE& sidUse)
   at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.GetSidFromAccount(String strAccountName)
   at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.GetSidFromAccount(UserProfileApplicationProxy proxy, Guid partitionID, String strAccountName, Boolean isWindowsAccount)
   at Microsoft.Office.Server.UserProfiles.UserProfile.set_SID()
   at Microsoft.Office.Server.UserProfiles.UserProfile..ctor(UserProfileManager objManager, String strAccountName, String strPreferredName)
   at Microsoft.Office.Server.UserProfiles.UserProfileManager.CreateUserProfile(String strAccountName, String strPreferredName)
   at Microsoft.Office.Server.UserProfiles.UserProfileManager.CreateUserProfile(String strAccountName)
Any help?
Thanks,
Mohakk

Hi,
Per my understanding, the code should be OK, I have two suggestions as below:
1. Please ensure that the account of that user is valid in your production environment;
2. Try other accounts in the CreateUserProfile() funciton to see if it can work.
Feel free to reply if there any progress.
Best regards,
Patrick
Patrick Liang
TechNet Community Support

People Picker search order with multiple forest domains

I had customer with multiple forest domain environment. Now the problem is that all users from one domain synced to the resource domain(Domain A) where sharepoint is installed.
The peoplepicker is now finding at first the user in Domain A where sharepoint is installed. My Solution is now to specify the order of searching in People Picker that first all users in Domain B will return and if there is noting will return Domain A.
All SharePoint Server(s) had Network Access to the other Domains. And there are two-way-trust konfigured.
Any Solution for that?
Thanks for your feedback!
P.

Regardless of search order, you would get both results returned. Have you tried using the UserAccountDirectoryPath property on the Site Collection to specify DC=domainB,DC=com?
Trevor Seward
Follow or contact me at...
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.
Nice to now that i can set it up per site collection. But it do not work in my case, it indeed returned users from Domain B but Domain A, C, D and F(Examples) are excluded from People Picker.

AD DS New Forest Domain Naming Problem

Hey everyone,
I'm having a bit of a conundrum about the new forest domain name and what possible implications it can have if I chose the wrong name convention...
Current Setup
The current issue is that the company I work for was bought out by another company and atm, where using a 2-way forest trust.
The company also has another site in Africa which is using a different forest domain but doesn't have any forest trust to either of the other 2 domains.
The current forest domains are:-
1. Company1.local (my old company)
2. Company2.com.au (main company)
3. internal.company2direct.com.ke (Africa site)
To make it worse, all three sites have their own Exchange environment and there's all types of file share/application authentication issues between sites.
Therefore, the company has decided that they want to get rid of all the exchange environments/file shares and so forth and move everything to
Office365, including SharePoint and Lync
New Solution
They have also decided that they want a new forest with a single domain and that the locations and security will be delegated by using different OU structures/GPO's as it's all going to administered by 2 people at the main company site. This is non-negotiable
as they don't want sub/child domains or different forests, just a single entity.
They're using a third party to do the Office365 design and implementation. However I have been assigned to setup the new initial ADDS server for the new forest.
After some reading I've found that we really shouldn't be using '.local' or '.internal' for the forest root domain. I suggested that we use 'internal.thecompanynamethatisreallylong.com.au' and a NetBIOS of 'CNF' (which is actually that long,
and I feel that if we have to use a FQDN for anything then it will cause an issue)
They want me use the following for the forest root domain ' au.cnf' with a NetBIOS of 'CNF'
Is that really such a good idea or is there any situation whereby using 'au.cnf' as the
prefix.suffix could cause any issues?
I would of like to use 'internal.cnf.com.au' however the domain name 'cnf.com.au' is already registered by another company..
Once the new forest is created, I'll create a 2way trust between the companies and start using ADMT to migrate accounts across
Thanks in advance for you help

Hello,
for AD limits, especially amount of usable characters, please see
http://technet.microsoft.com/en-us/library/cc756101.aspx
Personally I would NOT use the "CNF" as NetBIOS domain name. "CNF" in AD stands for "Conflicting object" and this will be shown in dcdiag or repadmin outputs when conflicts are listed as doubled names for example.
For the internal naming I would always use short domain names. Top level domain names to avoid for WAAD and Office365 I would also check with the experts in http://social.msdn.microsoft.com/forums/azure/en-US/home?forum=WindowsAzureAD
and http://community.office365.com/en-us/f/default.aspx
You could use public TLDs but keep in mind that you have to configure split DNS that way.
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter:

Can the SidHistory attribute be moved from one User account to a different User account in the same Forest/Domain?

Hello,
Can the SidHistory attribute be moved from one User account to a different User account in the same Forest/Domain manually with Active Directory Users and Computers or with something like Powershell? it would seem to me this is a safe operation.
Thanks for your help! SdeDot

Hi,
In addition, please also take a look at the below thread:
copy SIDHistory from one account to another in the same domain
http://social.technet.microsoft.com/Forums/en-US/2ca8727c-b3fd-4ef8-9747-99295f0cd61c/copy-sidhistory-from-one-account-to-another-in-the-same-domain?forum=winserverDS
Hope this helps
Best regards
Michael
If you have any feedback on our support, please click
here.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

"following domains are not available" error - functionally trusted domains but with same NETBIOS dc computernames giving problems.

For SCOM monitoring and user permissions I am trying to add the Action Account from HQ.local domain to some other domains like DOMAIN1.local, TEST1.local and TEST2.local.
(a trust persists between the domains en HQ.local, and DNS Conditional forwarders are configured to correctly resolve the FQDN DNS names).
Problem is, when adding a user from the HQ.local domain to the Active Directory of the DC's SRVPDC01.DOMAIN1.local or SRVPDC01.TEST1.local domain I get an error:
"The Active Directory Domain Controllers Required to find the selected objects in the following domains are not available:
HQ.local
Ensure the Active Directory Domain Controllers are available, and try to select the objects again."
But when I try to do the same thing, so add user1 from HQ.local to the AD on TESTDC01.TEST2.local…. No error!
The other way around, like adding users from DOMAIN1.local, TEST1.local or TEST2.local to the DC01.HQ.local Active directory… also no error!
To make things even more strange, when I validate the trust with HQ.local… and then try to add user1.HQ.local -> No problem, but only for about 1 minute.. After that
it doesn't recognize user1.HQ.local and only displays some CN=S-1-5... ID of the user. Also when trying to add a new user, I receive the error again.
My guess is that the problem has something to do with the same NETBIOS names of the DC's (server 3 and 4). because authenticating users from HQ.local and TEST2.local
doesn't give me errors and all other domains which have same DC names are giving errors.
(for testing purposes I set-up TESTDC01.TEST2.local with a different DC servername to see if the error persists, and it didn't).
Overview of the servers and situation:
- All server 3, 4 and 5 are on separate Vlan's and have no connectivity among each other. But they do have connectivity to the internet, the HQ.local domain and its servers
DC01 and DC02.
- same firewall settings for each vlan
- even Server 4 and server 5 are on the same Vlan for testing purposes, just to make sure the firewall is not the problem.
Server no.
DC FQDN name
Domain DNS name
1
DC01.HQ.local
HQ.local
2
DC02.HQ.local
HQ.local (secondary DNS)
3
SRVPDC01.DOMAIN1.local
DOMAIN1.local
4
SRVPDC01.TEST1.local
TEST1.local
5
TESTDC01.TEST2.local
TEST2.local
Two-Way Forest Trusts are configured without any problems but here's an overview when the error occurs.
On SRVPDC01.DOMAIN1.local -> adding user1.HQ.local to the AD =
error
On DC01.HQ.local -> adding user1.DOMAIN1.local to the AD = no problem.
On SRVPDC01.TEST1.local -> adding user1.HQ.local to the AD =
error
On DC01.HQ.local -> adding user1.TEST1.local to the AD = no problem.
On TESTDC01.TEST2.local -> adding user1.HQ.local to the AD = no problem.
On DC01.HQ.local -> adding user1.TEST2.local to the AD = no problem.
What are my options to fix this? There must be more possibilities than renaming the DC names.
And why does the problem only occur when adding users in Foreign domain ->from-> HQ.local and not HQ.local ->from-> Foreign domain. Because that's the only
thing I really need: users from HQ.local having permissions in groups of the other domains… :(
Any advise or help would be much appreciated. I've been struggeling with this for a while now and i'm pretty much out of ideas.

Hi aperelli,
On srvpdc01.DOMAIN1.local
nslookup
set type=all
_ldap._tcp.dc._msdcs.hq.local
Result:
C:\Windows\system32>nslookup
DNS request timed out.
    timeout was 2 seconds.
Default Server: UnKnown
Address: ::1
> set type=all
> _ldap._TCP.DC._msdcs.HQ.local
Server: UnKnown
Address: ::1
Non-authoritative answer:
_ldap._TCP.DC._msdcs.HQ.local SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = dc01.hq.local
_ldap._TCP.DC._msdcs.HQ.local SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = dc02.hq.local
dc01.hq.local internet address = 192.168.1.200
dc02.hq.local internet address = 192.168.1.201
=======================
On srvpdc01.TEST1.local
nslookup
set type=all
_ldap._tcp.dc._msdcs.hq.local
Result:
C:\Windows\system32>nslookup
DNS request timed out.
    timeout was 2 seconds.
Default Server: UnKnown
Address: ::1
> set type=all
> _ldap._TCP.DC._msdcs.HQ.local
Server: UnKnown
Address: ::1
Non-authoritative answer:
_ldap._TCP.DC._msdcs.HQ.local SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = dc01.hq.local
_ldap._TCP.DC._msdcs.HQ.local SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = dc02.hq.local
dc01.hq.local internet address = 192.168.1.200
dc02.hq.local internet address = 192.168.1.201
=======================
On DC01.HQ.local
nslookup
set type=all
_ldap._tcp.dc._msdcs.domain1.local
Result:
C:\Windows\system32>nslookup
Default Server: dc01.hq.local
Address: 192.168.1.200
> set type=all
> _ldap._tcp.dc._msdcs.domain1.local
Server: dc01.hq.local
Address: 192.168.1.200
Non-authoritative answer:
_ldap._tcp.dc._msdcs.domain1.local      SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = srvpdc01.domain1.local
srvpdc01.domain1.local     internet address = 10.0.113.150
=======================
I have tested port 3268 and 3269 with Port Query UI and ports are listening on alle DC servers.

The specified forest functional level is invalid. "Lync Server" requires forests running in Windows 2003 mode or higher.

Dear Support Team,
i am having the error ''The specified forest functional level is invalid. "Lync Server" requires forests running in Windows 2003 mode or higher'' from lync 2013 during the schema master prepare on windows server 2008r2 and my forest functional
level are 2008r2.. so can you help me please...?

Dear Support Team,
in my network there are one forest and two domain controller (primary and secondary).. my domain functional
level is windows server 2008r2.. but i am still receiving error.. when i hit the run button for schema prepare its says:
ServerSchemaPrepareTask execution failed on an unrecoverable error.
and when i open log it sasys:
Error: The specified forest functional level is invalid. "Lync Server" requires forests running in Windows 2003 mode or higher.
kindly help me

Active Directory Cross Forest Domain Migration

Dear All,
We are in the process to rebuild new Active Directory infrastructure. Multiple single forest domains in organization which needs to be consolidated/migrated on single Active Directory Domain. For this consolidation, have some queries to be addressed before
going to start consolidation.
What is the best practices and what tool should we use for domain migration/consolidation
Active directory is on Windows 2003, forest and domain level is on Windows 2003, this will support to Windows 2012 R2 forest and domain functional level, will be migrated
directly from windows 2003 to windows 2012?
When move users to new domain, how will they access the other resources on the network. For e.g. Printer, File server, local web base application
After moving some computers to new domain would be possible to access remaining computers on old domain?
How the file server data will be moved? Best practices with NTFS folder permissions and users rights?
Is there any policy to register network printers on new Active Directory domain?
How users would be access web base application on new domain as their FQDN would be define with old domain name? Any option to change old domain FQDN with new domain that would be describe with any URL link?
Kindly give your valuable input to meet the desire result.
Thanks in Advance.

Dear Lucky,
Ya you can Migrate contents from multiple forest domain. Using ADMT (Active Directory Migration Tool)is the best way to migrate AD content. But you can't migrate from Windows Server 2003 to Windows Server 2012 R2, cause in Windwos Server 2012 R2 don't
have the supportebility of Windows Sever 2003.And not only users you can also migrate all others info (i.e. Computer object info, groups info, Exchange mailbox info, security info).You can migrate users face by face, means which peoples are in old domain they
can access old domain and new users are in new domain.For more info please follow the given link:
http://technet.microsoft.com/en-us/library/cc974332(v=WS.10).aspx
Mithun Dey Web: http://cloudmithun.wordpress.com If this may give your necessary resolution please mark it as Answre.

"Could not authenticate the specified user" error in HFM 9.2.1

Hi,
I'm installing Hyperion 9.2.1, and I have installed and configured shared service and hfm successfully, but when I failed to create hfm application.
The reproduce step is:
1. login http://hostname/hfm/Home/LaunchPage.asp, with admin/password
2. click a cluster, and click "create applcation", it failed with error:
Could not authenticate the specified user. %0
Error Reference Number: {184D6C1E-94C5-4722-93B0-15D88871485B}
And error in the log file is:
ERROR Authentication not found user appqa-vm05\admin 。
com.hyperion.hfm.security.CASSecurityException: not found user appqa-vm05\admin。
at com.hyperion.hfm.security.Authentication.AuthenticateUserInternal(Unknown Source)
at com.hyperion.hfm.security.Authentication.AuthenticateUserAndGetInfo(Unknown Source)
Have you ever met this issue?
Thanks,
Xinying

Hi J,
Thanks for your response.
<<1. The user with you are logging in HFM is used for configuring HFM
My OS is windows 2003 server, I installed and ran configurator of shared service and hfm with the OS user "administrator".
And I can login shared service with "administrator", but I met issue when creating hfm application. Also can login hfm" with admin/password" , but has same issue for creating application. Seems user is not checked when loging hfm.
<<2. This user is able to log on to Shared Services and is provisioned for creating HFM application
I can login shared service with user "admin/password".
But when clicking "provision" for user "admin", I can only find "shared service" role, no any hfm role.
user "administrator"
<<3. This user is used in Server and web configuration of HFM
In server and web configuration, I set the DCOM domain user as: hostname\administrator
In my setup, two users are used,
1st one is OS user: administrator
2nd user is: admin ( seems it is the default user after installation and configuration of Shared service?)
Thanks,
Xinying

Objects showing from another forest\domain ...

Hello Community
    On Windows 2008 Server when I go to Windows Explorer, under "Network"
in the right pane there are 4 columns:
Name               Category              WorkGroup
Network Location
    It is here that I see my server's names under "Name", Computers under
"Category", NetBios name under "Workgroup" and FQDN\Forest name under
"Network Location" which is fine.
    However in addition to my own objects that I see in the right pane of
Windows Explorer I also see objects from another domain the exists in
a totally separate forest, how can I see or how could those objects reside
or be displayed in my forest\domain (unless someone else put them there)?
    Thank you
    Shabeaut

Hello Susie Long
    There is only one network.
    There are 2 separate forests.
    Each forests has has separate domains.
    Under "Network" not all of the objects from the other domain
in the other forest are being displayed, only some of the objects
from the other domain in the other forest are being displayed under "Network"
in this forest.
    That is what is puzzling, are you saying that all of the objects from
the other domain in the other forest should be visible in this forest and if
so why aren't all of the objects visible (I was under the impression that
only the objects in this domain in this forest should be visible under "Network"
in this forest)?
    Thank you
    Shabeaut

Unable to find domain controller for the specified domain. Please explicitly specify the domain controller.

Im getting error "Unable to find domain controller for the specified domain. Please explicitly specify the domain controller." when I try to create an AD connection for my User Profile Service. The entire sharepoint environment is installed
on one server. That server has everyting on it, AD, SQL, Sharepoint, and its the domain controller. I cant figure out why this will not identify?Trevor Fielder

Hi,
Did you get this error when clicking on the Populate Containers button?
If yes, please make sure that you have provide the domain credentials in the account name and password
boxes below when entering the domain information. The account must be granted the replicating directory changes permission on the domain.
You can refer to this blog:
http://www.harbar.net/articles/sp2010ups.aspx
Xue-Mei Chang

Lync 2013 and Raising Forest/Domain Functional Level?

My current forest and domain functional levels are 2008 R2. I know I can safely upgrade the functional levels in most cases, but I want to specifically know with regards to Lync.
Our entire environment, including Lync, is running on Windows Server 2012 R2. (We have no domain joined clients.) We are running Lync 2013 Standard with all the latest updates.
Can I safely raise the forest and domain functional levels to 2012 R2 without impacting Lync?

Hi,
Yes, you can raise Forest and domain function level to Windows Server 2012 R2 without issue.
After raising Forest\domain function level, the new features that rely on the functional level are generally limited to AD itself. Regardless, changing the Domain or Forest Functional Level should have no impact on an application that depends on
Active Directory.
More details:
http://blogs.technet.com/b/askds/archive/2011/06/14/what-is-the-impact-of-upgrading-the-domain-or-forest-functional-level.aspx
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Restructuring Forest-Domain - Best Migration Tool

Hello,
My Client is about proceed towards a multiple Forest-Domain strategy,
We have studies some of the product available for the migration of the object to new domains,
Quest Migration Manager (now dell), Smart AD Migrator (BinaryTree), ADMT (Microsoft)
However apart from these tools which are capable of migrating standard objects types from directory to other..
for e.g.: users, computers, groups, My client has Embbeded PCs, Micro-Terminals etc..
I need to know what all Tool->Vendor are capable of migrating unknown, rarely used, custom made objects.
An Extremist

ADMT is a good migration tool. I already used it to migrate 60k + AD objects.
I am not sure about support of PCs running Windows Embedded but you can give a try. If it does not work then I am not aware about a Microsoft tool to manage that.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

I cannot log onto sites that require my log in and password. I get no error message, fire fox just goes back to the same empty log in screen. this problem is not limited to one site. I reloaded firefox with same results.

When i type in my log in and password and enter, the site either returns to the blank screens or does nothing. This is not limited to one or two sites. all of my financial institutions, electric company, insurance companies, even trying to register here so that i could ask this questions. In this situation, when i hit the register button, nothing happend, its as iff the button is inactive. i had to go to IE to register and post this question. I just tried to enter my new log in and pw on the screen in fire fox and nothing happens. Some sites behave differently when i hit the submit or log in button. the information seems to be transmitted but the screen comes right back to the original log in screen with blank fields. there are no error instructions that something does not match or is missing. then i go to IE and it works.
This started a few weeks ago. I cant identify anything that was added around that time but i tried a system restore and that did nothing. i deleted fire fox and downloaded the latest version 3.6.13 and it is still happening

This issue can be caused by corrupted cookies.
Clear the cache and the cookies from sites that cause problems.
"Clear the Cache":
* Tools > Options > Advanced > Network > Offline Storage (Cache): "Clear Now"
"Remove Cookies" from sites causing problems:
* Tools > Options > Privacy > Cookies: "Show Cookies"
*http://kb.mozillazine.org/Cookies

Could not delete from specified table?

hi all,
i'm getting this error could not delete from specified table when i execute a delete on dbf file via JDBC-ODBC bridge, when i execute an update table command i get operation must use an updatable query, but i'm not updating the query returned from select statement.
Does anyone have similar problem before??

Hi,
my code is below:
try {
conn=DriverManager.getConnectio("jdbc:odbc:sui","","");
stmt = conn.createStatement();
int r= stmt.executeUpdate("Update Alarms set ACK=True WHERE DT = { d '" + msgdate + "' } AND TM= '" + msgtime + "'");
System.out.println(r+" records updated in Alarms ");
stmt.close();
conn.close();
stmt=null;
conn=null;
catch (NullPointerException e) {System.out.println(e.getMessage());}
catch (SQLException e) {System.out.println(e.getMessage());}
I have an ODBC datasource called sui and a table called alarms, i need to write into the column Ack to true when DT equals msgdate and TM equals msgtime, the error returned is Operation must use an updatable query.
I believe the SQL has no problem because there is no SQL syntax error and i'm not updating any resultset returned from select query.
When i delete, i get could not delete from specified table. Anyone has any idea wh'at's wrong?

PeoplePicker-SearchADForests not limiting to specified forest domains

Similar Messages

Maybe you are looking for