Add different AD forest or domain for access SharePoint 2019 sites

Question

Add different AD forest or domain for access SharePoint 2019 sites

Yeung, Patrick CP 66

Hello,
May I ask you for this matter, I have a situation with SharePoint 2019, and i ran this command and it shows "Operation completed successfully.
the command I ran in SharrePoint 2019 Management Shell, which is

stsadm -o setproperty -pn peoplepicker-searchadforests -pv "forest:resource.com;forest:user.com;domain:resource.com;domain:user.com" -url https://my-sp-site:9445/

It shows "Operation Completed Succesfully, But i try to go to the url and login with resource.com Admin user and in the Site Setting\Site Permission to add user for any users from user.com, when typing, it always shows "Sorry, we're having trouble reaching the server.

I try th article below as well, the command is pretty the same, but with login account for the like the User domain and password, and also it shows "Operation Completed succesffully" but still get the same "Sorry, we're having trouble reaching the server"

https://learn.microsoft.com/en-us/sharepoint/troubleshoot/people-picker/stops-resolving-other-domain-users

Can you further advise, and what i did as well,

should apply the command in Web Server? (we have 3 tier , app, web, and ms sql)
I did restarted the IIS for this URL, but still can't search any users for user, and it shows "Sorry, we're having trouble reaching the server
We have the one-way trust, from user.com (which I understand is the trusting domain) trusting with resource.com (which is trusted domain, all sharepoint web, app, and sql reside in)
how to determine should use forest or domain in the command? and put the login account and password? and should includes < > for the login account and password?

Thank you so much!

Ling Zhou_MSFT 23,690 Reputation points Microsoft External Staff

2023-06-06T01:45:06.96+00:00

Thank you for your question.

We are currently looking into this issue and will give you an update as soon as possible.

Thank you for your understanding and support.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
هيام الملحم 0 Reputation points

2023-06-08T19:30:27.8166667+00:00

أنتظر الإابة أيضا

3 answers

Your answer

Ling Zhou_MSFT 23,690 Reputation points Microsoft External Staff

2023-06-06T01:45:06.96+00:00

Thank you for your question.

We are currently looking into this issue and will give you an update as soon as possible.

Thank you for your understanding and support.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
هيام الملحم 0 Reputation points

2023-06-08T19:30:27.8166667+00:00

أنتظر الإابة أيضا

Answer 1

Ling Zhou_MSFT 23,690 Microsoft External Staff

Hi @Yeung, Patrick CP,

Thank you for posting in the community.

1, Yes, you need to run the command for every Web Front End server in your farm.

2, If the AD domain has a 1-way trust, then you need to specify a username and password first, execute the following commands on every server in the farm:

stsadm -o setapppassword -password <Password>

Ensure you use the same password for each server you execute this command on!

After executing this command, then execute your peoplepicker-searchadforests command.

3, Whether you use forest or domain in the command depends on whether you want to connect two forests or domains. The value after -pv is a valid list of forests or domains. The format of the list of forests or domains value includes the following:

forest:DnsName,LoginName,Password
domain:DnsName,LoginName,Password

Here is the example:

stsadm -o setproperty -url http://<server:port> -pn peoplepicker-searchadforests -pv "forest:contoso.corp.com,LoginName,Password;domain:bar.contoso.corp.com,LoginName, Password"

Here are some articles with more detailed information about the commands you use, please check:

https://learn.microsoft.com/en-us/previous-versions/office/sharepoint-2007-products-and-technologies/cc263460(v=office.12)?redirectedfrom=MSDN#syntax

https://www.sharepointdiary.com/2011/06/configure-people-picker-for-multidomain-forest.html

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Yeung, Patrick CP 66 Reputation points

2023-06-07T04:12:01.3266667+00:00

Hello Ling,

Thanksl for reply and detailed information!

Is this command stsadm -o setapppassword -password <Password> which I define the password?

and command for resource and user domain should be as below when I want to add to search both domains? resource is SP farm, user is User domain, and now is just One-Way trust from User trusting Resource. (trusted domain)

Can you advise should i use Forest or Domain ? Based on this trust relationship?
and the password I define in Above is NOT the resource and user domain login? (which is normal user right only?) - as I don't have have admin privilege on both user and resource domains

from NLTest command the Trust configuration is
c:\nltest /domain_trusts
trusted list
0: resource (NT5) (Direct Inbound) (Attr: Foresttrans)
1: user (NT5) (Forest Tree Root) (Primary Domain) (Native)

I further check with Infra team and known should be Forest type, so i run this command to all 3 x WFE and did reset IIS for https://xxxx:9445 site

stsadm -o setproperty -pn peoplepicker-searchadforests -pv "forest:resource, resourcelogin\r, password; forest:user, userlogin\u, password" -url https://xxxx:9445
It shows "Operation completed successfully".

But when i go to site and in Site permission, and in any group, i add and search like resource\xxx or user\xxx, it shows "Sorry we're having trouble reaching the server."

Can you advise?
Yeung, Patrick CP 66 Reputation points

2023-06-08T06:21:29.42+00:00

Hello Ling,
Would you look into my furter questions?
Ling Zhou_MSFT 23,690 Reputation points Microsoft External Staff

2023-06-08T07:43:48.1333333+00:00

Hi Yeung, Patrick CP,

I apologize for not responding in time. I'm still looking for information about your question. I'll get back to you as soon as possible.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 2

Hi @Yeung, Patrick CP,

If you encounter problems again, you can continue to ask a new question you encounter in this community. We will continue to help you solve your problems.

If you need better help, you can open a ticket for your issues. Here is the link: Global Customer Service phone numbers

Here are the methods to view ULS logs：

First, we can use Event Viewer. Open Event Viewer->Windows Logs ->Application. You can find error messages related to SharePoint here.

This is a detailed description of the use of the Event Viewer: What Is the Windows Event Viewer, and How Can I Use It? (howtogeek.com)

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

Second, we can use ULS Viewer to check SharePoint ULS Logs. Please download here: Download ULS Viewer from Official Microsoft Download Center

This tool is suitable for viewing ULS Logs for SharePoint Server 2013, 2016, 2019.

By default, SharePoint maintains log inside the 14/15/16 hive folder, which is in C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14/15/16\LOGS.

Open Logs with ULS Viewer, then set the conditions to filter the error messages.

Correlation IDs are unique, and error messages can be easily found by querying the Correlation ID.

This is a detailed description of the use of the ULS Viewer: How to Use ULS Log Viewer to Analyze SharePoint Errors? - SharePoint Diary

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

For the question about "No results found":

1, SharePoint will take a while to configure the people picker, so you can check again after half an hour to see if the problem still exists.

2, Please try clearing your browser cache or change your browser to use People Picker and see if the problem persists.

3, There are many reasons that can cause this problem, if the problem persists, please send me the relevant ULS Logs, which can help me to solve the problem better. Please note that your private information will be coded. Thank you for your cooperation!

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Yeung, Patrick CP 66 Reputation points

2023-06-13T06:51:46.27+00:00

Hi Ling,
how can i send log file to you privately?
Ling Zhou_MSFT 23,690 Reputation points Microsoft External Staff

2023-06-13T08:28:08.9666667+00:00

Hi @Yeung, Patrick CP,

For your security, it is best not to send me the file privately. You can take a screenshot of the log file and then code your private information. If there are fewer pictures, you can post them in the comments, and if there are more pictures, you can post them in the answers.
Yeung, Patrick CP 66 Reputation points

2023-06-13T09:28:22.35+00:00

Hi Ling,

When the time i searched, pls find ULS log, it can only search the account i set for the command userdomain\abc, but other users and groups can't find. please see these 4 x pictures

uls 2.PNG
only can search 1 user for user domain.png

only can search 1 user for user domain 2.png

Answer 3

Ling Zhou_MSFT 23,690 Microsoft External Staff

Hi @ Yeung, Patrick CP,

Apologies for the late reply!

For your case, your User Domain is trusted, and your SP farm is trusting. So, the User does not trust SP farm. This command "stsadm -o setapppassword -password <Password>" is used to configure the web application to use User credentials when executing People Picker operations against the User domain.

Here is a new article about how to configure People Picker for a one-way trust.

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

It introduces an “SPApplicationCredentialKey” command with the same functionality as the previous command provided.

Since we can't reproduce your situation, II offer some troubleshooting for "Sorry we're having trouble reaching the server." Please check out these articles:

Troubleshooting: People Picker error "Sorry, we’re having trouble reaching the server"

Troubleshooting - 'Sorry, we’re having trouble reaching the server'

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Yeung, Patrick CP 66 Reputation points

2023-06-09T06:21:29.1766667+00:00
Hi Ling,

I read and tried this - https://joshroark.com/sharepoint-how-to-configure-people-picker-for-a-one-way-trust/

Still getting "Sorry, we’re having trouble reaching the server"

Can you advise for me?

what domain privilege\permission should be needed for the user domain account ? Like "Directory-level" permission?

Can you escalate my case to Josh Roark? I can't find a way to create a wordpress account to ask questions to him.
Yeung, Patrick CP 66 Reputation points

2023-06-12T02:01:22.7+00:00

Hi Ling,

May you update me the above inquires? We are really needing Microsoft to help.
Ling Zhou_MSFT 23,690 Reputation points Microsoft External Staff

2023-06-12T02:39:54.8366667+00:00

Hi @Yeung, Patrick CP,

Apologies for the late reply!

First, I am sorry to say that I don't understand what "domain privilege\permission" means. If you want your user domain account can access SharePoint, you can go to Gear Icon > Site Permissions>>Advance site permission>click on Grant permissions>Type the email address of an external user (different domain) and set proper permission level under "Select a permission level", click share. Here is the relevant link.

In addition, sorry, I don't have permission to escalate your case to Josh Roark. Because you are the author of the case.
Yeung, Patrick CP 66 Reputation points

2023-06-12T09:01:01.0966667+00:00

Hi Ling,

I meant the command as outlined by Josh, for adding the user domain like $newdomain2.loginname = "contoso\PPAccount", what is the type of AD permission should PPAccount be granted? Read or Directory-level" permission?

I also check that all necessary network ports have been opened from between the SP APP and WFE and the User domain, which I tried in Computer Management, Local Administrator group, in any server of resource domain to search any users from user domain, i can add them, so it proves the Trusted Relationship is working fine.

If I am the author and how can I reach him if i don't have his contact?
Ling Zhou_MSFT 23,690 Reputation points Microsoft External Staff

2023-06-12T09:49:13.66+00:00

Hi @Yeung, Patrick CP,

Depending on your situation, maybe you just want to read the user's information in User domain without modifying the user information. So, I think Read level is more appropriate.

Sorry, I have no idea to reach Josh Roark. If you want Josh Roark to see the question as well, you can ask him to find it in the community, or you can send him the link.
Yeung, Patrick CP 66 Reputation points

2023-06-12T10:29:54.4733333+00:00

Hi Ling,

Thanks for your prompt reply, as i mentioned earlier, I can't register to login his personal Wordpress.com website to log him a comment, and I don't have his email address, so how can I contact him to read this article?
Ling Zhou_MSFT 23,690 Reputation points Microsoft External Staff

2023-06-13T01:15:09.05+00:00

Hi @Yeung, Patrick CP,

I'm a little confused I don't know who Josh Roark is, so I don't know how to contact him. I'm afraid I can't help you here.
Yeung, Patrick CP 66 Reputation points

2023-06-13T01:47:47.7766667+00:00

Ok!

What can you do if I'm still can't configure this "add other domain to SP" issue?
After follow thr your recommended steps from Josh, I DIDN"T get "Sorry, we're having trouble reaching the server".

What better support can you side provide? If we have Enterprise licensee purchased?

What log from event viewer or ULS log i can provide when I tried to search any site I configured to search user domain\abc?

I use this step to open People picker as you said

can go to Gear Icon > Site Permissions>>Advance site permission>click on Grant permissions> and type Userdomain\

, and now show "No results found"

Share via

Add different AD forest or domain for access SharePoint 2019 sites

3 answers

Your answer