Symptoms
In an environment in which the People Picker scope for the search and resolve functionalities is limited to a specific site collection, creating a subsite that has a unique permission fails.
Cause
When you create a subsite, three SharePoint groups are created by default. This process requires the groups to resolve the creator account by searching Active Directory. If Active Directory is not configured to be trusted, the group creation process fails.
Resolution
To solve this issue, install one of the following updates:
If the Active Directory trust can't be configured for a particular security requirement, we provide a new property, ByPassADResolveWhenSearchWithinSiteCollection, in web application objects of SharePoint Server. By setting this property to $true, you can force the account search in Active Directory to be skipped in order to avoid the group creation failure.
add-pssnapin * $wa = Get-SPWebApplication http://<yourWebAppUrl> $wa.Properties[“ByPassADResolveWhenSearchWithinSiteCollection”]=$true $wa.Update()
