Sharepoint 2010, People Picker (peoplepicker-searchadforests), 1 way Active Directory trust …. process monitor to the rescue!

If you run Sharepoint 2010 in one forest, users in another forest and a 1-way forest in-place.  There is some additional configuration needed in Sharepoint 2010.  I included links below that discuss the details.  My post is not to be in-depth how to setup, rather share a tidbit not discussed in documentation (not that I could find).  Thanks to a smart co-worker and process monitor, it was found there is a registry entry, the application pool needs READ access.  You can either manually grant permissions on the server or add registry permission in AD Group Policy.  Hope this helps.

People Picker overview (SharePoint Server 2010)

Configure People Picker (SharePoint Server 2010)

Peoplepicker-searchadforests: Stsadm property (Office SharePoint Server)

Application Pool needs read access
MACHINESOFTWAREMicrosoftShared ToolsWeb Server Extensions14.0Secure

Multi Forest/Cross Forest People Picker

Process Monitor

Steve Schofield
Microsoft MVP – IIS

One thought on “Sharepoint 2010, People Picker (peoplepicker-searchadforests), 1 way Active Directory trust …. process monitor to the rescue!”

  1. As it turns out, the application pool account gets its read-permissions on the given registry key by being a member of the local WSS_WPG group and therefore there’s no need to explicitly give these permissions manually or by group policy.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: