Connecting to Multiple Domains
We have 2 domains, SharePoint 2010 is installed on one Domain. We need a group of users from the other Domain to access SharePoint. What steps are needed to se
July 3rd, 2014 12:45am

If you have a forest-wide two way trust, there should be nothing further you need to do. What type of trust is in place between the domains?
Free Windows Admin Tool Kit Click here and download it now
July 3rd, 2014 1:14am

We have not setup the other Domain yet, but will be shortly. I just want to be aware if there is anything I need to setup on SharePoint Central Admin?
July 3rd, 2014 1:40am

If this is a child domain of the existing forest, you won't need to do anything. If it is a second forest, you'll need to create a trust in Active Directory Domains and Trusts. Given it is a two-way forest-wide trust, you won't have to do anything.

If it is a one-way trust, you'll need to do some PowerShell work.

http://thesharepointfarm.com/2014/01/powershell-for-people-picker-properties/

Namely execute this once:

$key = ConvertTo-SecureString "Password1" -AsPlainText -Force
[Microsoft.SharePoint.SPSecurity]::SetApplicationCredentialKey($key)

And for each Web App:

$wa = Get-SPWebApplication http://webAppUrl
$adsearchobj = Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain
$userpassword = ConvertTo-SecureString "UserPassword1" -AsPlainText -Force #Password for the user account CONTOSO\s-useraccount
$adsearchobj.DomainName = "contoso.com"
$adsearchobj.ShortDomainName = "CONTOSO" #Optional
$adsearchobj.IsForest = $true #$true for Forest, $false for Domain
$adsearchobj.LoginName = "s-useraccount"
$adsearchobj.SetPassword($userpassword)

$wa.PeoplePickerSettings.SearchActiveDirectoryDomains.Add($adsearchobj)
$wa.Update()

In addition, regardless of the type of trust, SharePoint servers must have port access to the other domain's Domain Controllers. See http://blogs.technet.com/b/wbaer/archive/2009/01/21/people-picker-port-protocol-requirements.aspx for details on requirements.

Free Windows Admin Tool Kit Click here and download it now
July 3rd, 2014 1:44am

Plan for host-named site collections (SharePoint Foundation 2010)

http://technet.microsoft.com/en-us/library/cc288637%28v=office.14%29.aspx

July 3rd, 2014 1:46am

What if we only want the users from Domain B to have access to SharePoint? Would we still need a two way trust?
Free Windows Admin Tool Kit Click here and download it now
July 3rd, 2014 5:48pm

What domain does SharePoint reside in? Domain A or B? And is this a new forest, or are Domain A and B in the sa
July 3rd, 2014 6:11pm

SharePoint is in Domain A. There is just one Forest with Domain A in it. When Domain B is created we want users from Domain B to be able to access SharePoint 2010.
Free Windows Admin Tool Kit Click here and download it now
July 4th, 2014 10:13am

Oh, there is no work required for the people picker. There is an automatic trust in place when the domains are part of the same forest. As for only allowing access to Domain B users, I would just not add Domain A users. Alternatively, create a group in Domain A that covers all of the users you want to deny access to (because you don't want to deny access to administrators or service accounts) and put a User Policy on the Web Application that denies access to the Web Application.
July 4th, 2014 12:28pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics