0

I have a service account that is in our SharePoint and needs to be removed. The account still needs to exist in AD, just not in SharePoint. This account is from an OU that is not selected in the "Edit synchronization connection" settings on the UPSA.

I have tried setting the UPSA to -PurgeNonImportedObject $true in PowerShell and running the profile sync again, but this did not resolve my issue.

Is there a way to sync SharePoint with AD and remove any user that is not set to be imported?

Improve this question
3
  • anybody login with that account into SharePoint? did you try to delete the User profile from UPA?it will not delete the id in AD.
    – Waqas Sarwar MVP ♦
    Commented Apr 14, 2016 at 15:53
  • Yea, there is a mysite that has been created and postings have been made under that account. I have not tried just deleting it from SharePoint directly yet. I was hoping there was a way of doing it with the sync process.
    – MickB
    Commented Apr 14, 2016 at 16:01
  • If the account has access to SharePoint the profile will be recreated when next accessed.
    – Matthew McDermott
    Commented Apr 15, 2016 at 11:49

3 Answers 3

Reset to default
0

Even if OU is not on Import List, But if a user browses the site then SharePoint will create a profile for it.

If you don't want the user's my site then Delete it and Delete the profile from UPA. It will not delete the ID from AD.

Now, if someone again login with that service account, SharePoint will create the profile again.

Improve this answer
2
  • Is there a way to at least purge these accounts if they have been created by an unsuspecting user perhaps?
    – MickB
    Commented Apr 14, 2016 at 16:09
  • i think, you have to write some kind of code for this.
    – Waqas Sarwar MVP ♦
    Commented Apr 14, 2016 at 16:10
0

You can schedule PowerShell to remove a specific account, or adapt this to remove more than one account, or an account based on any property available with the UPSA.

$wa = Get-SPWebApplication -IncludeCentralAdministration | ?{$_.DisplayName -match "Central"}
$site = $wa.Sites[0]
$ctx = Get-SPServiceContext -Site $site
$upm = New-Object Microsoft.Office.Server.UserProfiles.UserProfileManager($ctx)
$profiles = $upm.GetEnumerator()

foreach($up in $profiles)
{
    if ($up["AccountName"] -contains "ServiceAccountName")
    {
        Write-Host -ForegroundColor Yellow "Removing profile for $($up['AccountName'])..."
        $upm.RemoveProfile($up)
    }
}
Improve this answer
0

Remove profiles after profile-import process probably would work, but another nice solution is to "filter" your service accounts before profile sync.

Try to:

1 - Central Administration

2 - Manage Service Applications

3 - User profile Service Application

4 - Configure Synchronization Connections

5 - Select your sync connection and try to "Edit Connection Filters".

We have managed to filter our service accounts using this filters... With this technique we avoided the use of PS scripts and other custom solutions.

PS: If you choose to go with PS Script approach, please consider that any user profile sync would probably recreate the profiles removed by the script.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.