title: Sharepoint peoplepicker fails to find users from trusted domain
body: <p>I have a problem that consumed long hours from me without a viable solution. I have no experience on Sharepoint and it is possible that I am overdoing it, I would not be surprised if the solution is much simpler than I expected.</p>
  
  <p>The scenario is as the following:</p>
  
  <p>1) We have a SharePoint installation at Client (A). Client (A) environment consists of <strong>testing</strong> and <strong>production</strong> environments. The <strong>production</strong> environment a separate server for each WFE and for BEDS. The <strong>testing</strong> environment consists of WFE &amp; BEDS in a single server. Both environments are on the same domain.</p>
  
  <p>2) Sharepoint version is 2013.</p>
  
  <p>3) Client (A) established two-way trust relation with Client (B) domain.</p>
  
  <p>The problem: The production Sharepoint PeoplePicker can successfully grab users from Domain (B)  with <em>no configuration done at PeoplePicker at all</em>. However, the testing Sharepoint PeoplePicker fails to grab domain (B) trusted users. And fails with "Cannot find exact match" error.</p>
  
  <p>I tried the following solutions on the <strong>testing</strong> environment (where WFE &amp; BEDS are colocated) to locate the issue:</p>
  
  <p>1- Checking all PeoplePicker relevant properties (Peoplepicker-searchadcustomquery, Peoplepicker-onlysearchwithinsitecollection, Peoplepicker-searchadforests, setsiteuseraccountdirectorypath,etc.) and nothing at all. Also, I ran people picker port tester on both environments (<strong>production &amp; testing</strong>) to compare any firewall configuration differences, even though some ports are complaining and differences between UDP ports (445,135) exists, still, I dont think it is the problem as Wireshark step (3) later will tell why it is not a possibility. From what I read on the internet, I have to configure nothing for people picker in two way trust scenario, still tried to do one way trust configuration, nothing works &amp; I reverted the changes.</p>
  
  <p><a href="https://i.stack.imgur.com/2JnNa.png" rel="nofollow noreferrer">PeoplePicker port tester run results</a></p>
  
  <p>2- Configured Sharepoint to verbose logging (all components since I do not know which is responsible for PeoplePicker) collected logs and searched the logs for the queried user. No useful information, a screenshot is attached from ULS Viewer, the user is masked. </p>
  
  <p><a href="https://i.stack.imgur.com/deGPC.png" rel="nofollow noreferrer">Sharepoint logs</a></p>
  
  <p>3- Collected Wireshark traffic dump and filtered by LDAP. I can clearly the that the LDAP response contains the queried user from the trusted along with all user attributes and domain name. That is why I excluded any people-picker filtration reasons ,domain search limitations or network ports issues. Screenshot is attached.</p>
  
  <p><a href="https://i.stack.imgur.com/hlf8N.png" rel="nofollow noreferrer">Wireshark trace</a></p>
  
  <p>4- After excluding the network issue (as LDAP query returns to WFE successfully), I decided to see how the flow inside Sharepoint goes before showing the result in PeoplePicker. If found <a href="https://msdn.microsoft.com/en-us/library/dd357076.aspx" rel="nofollow noreferrer">this</a> article from Microsoft, describing PeoplePicker workflow. From the diagram below, I can conclude that the LDAP request successfully passed steps 1,2 and 3. I need to check steps from 4 to 11 which are MS-WSSFO protocol handshakes. I read about the protocol, and found it consists of group of stored procedure calls from WFE to BEDS. I tried to debug the protocol by using SQL Server Profile and searching for (proc_GetTpWebMetadataAndListMetadata) &amp; (proc_GetListMetadataAndEventReceivers) stored procedures but nothing found.</p>
  
  <p><a href="https://i.stack.imgur.com/UUQ4a.gif" rel="nofollow noreferrer">PeoplePicker flow</a></p>
  
  <p>5- A friend of mine suggested configuring UPSA (User Profile Service Application) connection to the trusted domain (Domain B) active directory, I granted Sharepoint service users the required permissions on (Domain B) active directory, configured the connections and tested the synchronization and it does load users as I can see from Synchronization Service Manager, however, PeoplePicker still fails. However, I think this step was unnecessary as PeoplePicker and UPS are not related as far as I know, and since Production Sharepoint PeoplePicker is working fine without configuring UPSA.
  Any help please?</p>