Display a list of user profiles that are missing from the AD import?

Question

How can you display a list of user profiles that are missing from the AD import?

I know you can go to Manage User Profiles and search for individual users that are missing, but it doesn't seem to allow you to list all missing users. Ideally I would like to get this list with Powershell so further processing can be undertaken.

The below command will display users who are present but have never been imported from AD. Nearly there, but not quite what I am after. I need a lit of users who were initially brought in as part of the sync, but are now missing from the import. I know Sharepoint does flag these, because as per above I can see them under Manage User Profiles.

Set-SPProfileServiceApplication -Identity $upa -GetNonImportedObjects $false

Answer 1

Alernatively, you could look at the Forefront Identity Manager tool (the software that actually does the Sync) to look at the import/export errors. This would help you identify the users who did not sync and give you more information about how to correct the issues on their accounts.

The tool can be found at C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\miisclient.exe

DON'T MAKE ANY CONFIGURATION CHANGES IN THIS TOOL. You could royally mess up your profile syncs. On the Operations section (which opens by default) you can look through your sync history, however I would avoid everything else in that tool =)

Answer 2

I know Microsoft says not to do it, but if you want to get a SQL view of all the Users and their properties in the User Profile service, you can set up somthing like what is described here:

http://iedaddy.com/2012/03/sharepoint-2010sql-view-to-get-user-profile-property-bag-values/

At which point you can filter based on the properties you want to look at.

Answer 3

You can still use the Manage User Profiles page to do this - just search on the domain name and you'll get all the results that match that. For example, if my NETBIOS domain name is GIRAFFES and my account is GIRAFFES\Hubbard, then I can put "GIRAFFES" in the search box and I'll get all results that match that.

If your NETBIOS domain name does not match the actual domain name (Win2k legacy stuff), then you'll want to search on both domains to get the full list.