We've been having random issues with people picker. We sometimes get an error message saying "Cannot find exact match". It effects different front end servers at different times. We can tell by using host files. So currently, I point to WFE1 and i get the error but when i point to WFE2 it works. This morning I received the error with both servers. An app pool recycle fixed the issue on WFE2 but not on WFE1. Currently I cannot resolve the issue on WFE1. App pool recycle, II Reset, reboot, fixing dcom errors that we thought might be related and running windows updates have all not worked. 

Anyone else seen this or have suggestions?

I though it might have started after one of our DC's were decommissioned but i cannot be certain since nothing specifically points to that currently. 

I've seen other articles referring to this but mostly from SP 2010 or when trusted domains are involved. The only other thing that might be relevant is that the WFE's are in the DMZ. But it was working and is a sporadic issue.

Hi Brian,

How do you access your SP farm (the web address)? are you using the front end names? or do you have a shared url for both front ends?

If you're using front end names, make sure you have both server names on your AAM settings

Normally it's access through a load balancer. So when not using the host file, the error starts happening, then use the host file to see which server is currently having the issue. 

Ok, so you are testing access directly to each front end (using the server name as URL, right?) but do you have an Alternate Access Mapping (on central Admin) configured to each one of front end servers?

if not, you must create it.

EX:

FrontEnd1 (server name), FrontEnd2 (server name), Sharepoint 80 (http://sharepoint) (your web application)

in your AAM settings you must have 

http://FrontEnd1 Default(or another) http://sharepoint

http://FrontEnd2 Default(or another)  http://sharepoint

http://sharepoint  Default(or another) http://sharepoint