SharePoint 2010: People picker not resolving all users from other domains with one-way trust

In a SharePoint environment in which you have a one-way trust domain configuration, you discover that the people picker is not resolving all users from other domains as needed.

Here is the fix:

1) On every server in the SharePoint farm, set an encryption key.

stsadm -o setapppassword -password Pass123!

2) Clear the existing peoplepicker-searchadforests property for the web application.

stsadm -o setproperty -pn peoplepicker-searchadforests -pv "" -url http://contoso.corp.com

3) Set the new peoplepicker-searchadforests property for the web application. The key point here is to add all domains that need to be available in the people picker within the same command.

Format:

stsadm -o setproperty -pn peoplepicker-searchadforests -pv "forest:<forest1 name>,<service account>,<password>;domain:<domain1 name>,<service account>,<password>;forest:<forest2 name>, <service account>,<password>;domain:<domain2 name>,<service account>,<password>" -url <web application>

Example:

stsadm -o setproperty -pn peoplepicker-searchadforests -pv "forest:ext.corp.com,corp\spservice,Password!;domain:ext.corp.com,corp\spservice,Password!;forest:corp.com, corp\spservice,Password!;domain:corp.com,corp\spservice,Password!;domain:uk.corp.com,corp\spservice,Password!" -url http://contoso.corp.com

Notes:

- The service account should have Read permissions for each domain, and the service account credentials should be the same for all instances listed in the command.
- In the example above, the third domain (uk.corp.com) is a child domain under corp.com. As you can see, there is no need to add another forest instance if it is a child domain.

Repeat steps 2 and 3 for each web application as needed.