When you have a SharePoint farm and you want to use accounts from another domain you need a partial (one-way) or a full (two-way) trust between those domains.

A full trust is not always desirable and there your problem begins. After setting up the one-way trust you can authenticate with an account from the trusted domain, but the SharePoint People Picker won’t show any accounts from this domain.

It has been documented by others before, but as I ran into this recently, I will give my summary how I fixed this.
This solution is the same for WSS 3.0/SharePoint 2007 as SharePoint 2010.

The problem

When using a one-way trust, you do not see any accounts from the other domain in the people picker.

The reason

This is an example of how you could use a partial trust.

You want to allow employees to authenticate in a development farm, but you do not want to allow any test or service account from the development domain to authenticate in the company domain.

As the application pool account is based in the development domain it doesn’t have the right to query the company domain.

The solution

Using STSADM we can configure which forests and domains are searched for accounts by setting the peoplepicker-searchadforests property. The best part is that we can supply a username and password for a trusted domain.

SharePoint does not allow you to store this username and password in plain text on the server. So, you will have to configure a secure store. If you skip this step, configuring the search account for trusted domains will always fail with the following message.

“Cannot retrieve the information for application credential key.”

To create a credential key, you will have to use the following command.

stsadm -o setapppassword
       -password <password>

This command has to be executed on every server in the farm.

Now you can configure the forests and domains you want to search using the following command.

stsadm -o setproperty
       -url <web application url>
       -pn peoplepicker-searchadforests
       -pv forest:<source forest>;domain:<trusted domain>,<trusted domain>\<account>,<password>

You can combine any number of forests and domains, but you need to specify at least one.
You also need to include all forests and domains in one statement because every time you execute this command it will reset the current settings.

Also note this setting is per web application, and even per zone.

Today the Microsoft Virtualization Team announced the availability of the new beta version of the Linux Integration Services for Hyper-V. There are three big changes in this version:

• Virtual machines will be able to use up to 4 virtual CPUs.
• Virtual machines will be able to synchronize their time with the parent partition.
• Virtual machines will be able to shutdown gracefully from the Hyper-V manager.

In this post I will try the new features.

Linux Integration Services for Hyper-V 2.0

First, I got a Virtual Machine (VM) installed as described in my previous post “Running CentOS 5.x on Hyper-V”. I used the current released stable version of the Linux Integration Services (LIS): Version 2.0.

My Hyper-V host only has a dual-core CPU. So, it is impossible for me to test the 4 CPU support. I could not find any differences with 2 CPUs.

Shutdown from Hyper-V Console

With the current version of the LIS when I press the shutdown button, I get the following error:

Time synchronization

With the current version of the LIS I had a lot of trouble with the clock of the VM getting out of sync very fast. I did a post to fix this: “Correcting time drift with CentOS on Hyper-V”.

I did not implement the mentioned fix on the VM I created for this post, to demonstrate the problem:

Linux Integration Services for Hyper-V 2.1 Beta

To get the beta drivers you need to download them from the Microsoft Connect website.

I installed the new drivers in exact the same way as the 2.0.

Not only the new version number is displayed, also the new Shutdown and Timesync channels are mentioned!

Shutdown from Hyper-V Console

Pressing the shutdown button now gives a more expected result:

Time synchronization

With the new LIS the time is pretty much stable, nothing the NTP service cannot handle. There is no need to change the boot command in grub anymore.