SharePoint 2010 & domain trusts – People Picker

SharePoint 2010 & domain trusts – People Picker

June 2, 2010

The last couple of days were filled with SharePoint 2010, domain trusts, tears, the great SharePoint community and last but not least: joy. It seems SharePoint 2010 is more strict when it comes to domain trusts, or simply communicating across multiple domains. I’ll try to share the most important things I’ve learned from this, the first regarding the People Picker. If anything mentioned here doesn’t make sense: feel free to ask / comment!

The problem with the People Picker is this: SharePoint does not resolve account names from the other (trusted) domain. It just cannot find it. You can open the firewall any way you like, it’s not going to happen. It won’t even try to contact the domain controller from the other domain. We need to tell SharePoint that it should search in other domains too. As of today, there doesn’t seem to be a PowerShell command to do this, so we’re going old school with stsadm.

First, we set an encryption key (execute this on each server in the farm):

stsadm -o setapppassword -password ******

 Second, we register all the domains that need to be searched for account names (this is done per Web Application, not per server)

stsadm -o setproperty -pn peoplepicker-searchadforests -pv domain:domainB.local;domain:domainA.local,domainA\account,password -url http://webapplication

That should be all! Remember that at least firewall ports 88, 139 and 445 should be open.

This particular problem is not SharePoint 2010 specific, SharePoint 2007 has the same issue. It is strange however that there is no PowerShell replacement for this. The need for cross domain name resolving is just as present today as it was 3 years ago, if not higher.