4

We have a list which has a person (people picker) column. This column pulls from (is validated against) several possible sources including Active Directory. If a name cannot be found when adding/updating a record then the following error message appears in red just below that field:

No exact match was found. Click the item(s) that did not resolve for more options.

We have a particular record we are trying to update. Per security policy former employees must be deleted from AD. Now, however, that the person in the person column of this record has left it is impossible to update his record due to the mentioned error message. His name won't validate even though he still exists in the User Information List.

How can this be overcome? Is it a configuration issue? It must be possible to update the record of a person who has been deleted from AD; otherwise, this would present major issues to organizations. We are considering using text for person names instead of system-validated person columns and clearly that would not be Microsoft's intent.

2

There isn't really a way around this with your company policy. When dealing with records from a user who is no longer there, it is better practice to deactivate their AD account rather than delete it. This would allow the user's profile to remain and you wouldn't have this issue.

However, since you are deleting users from AD, you could take a different approach with this list. Here are a few ideas:

1) Don't use the people picker, just use a text box

2) Use the people picker, but have a workflow append its data to a text field that is not editable

3) Use InfoPath to edit the list forms with and do something similar to #2 without the workflow

  • Our CTO indicates that Microsoft itself recommends that AD accounts be deleted when an employee departs -- that there's greater risk in merely disabling accounts. – Mario Jun 17 '14 at 17:09
  • Disabling accounts doesn't pose any security risks over deleting a user. It just means they can be enabled and have whatever access they previously had more easily. When you have systems that rely on the user information in AD, moving them to a "Disabled Users" OU and disabling the user is a common practice. Existing in AD, but being disabled, doesn't give any more surface area for a security risk than deleting them... – John Chapman Jun 17 '14 at 17:20
  • I was incorrect. This policy came not from Microsoft but CERT. CERT like CMMI was developed by Carnegie Mellon. – Mario Jun 17 '14 at 18:26
  • Because I got some conflicting information online we decided to seek a more official word from Microsoft. We utilized our premier support. Ultimately, we confirmed your reply. In light of our security policy the people picker won't work for us. I posted the workaround we actually used below. – Mario Jun 24 '14 at 17:20
0

Here's our workaround:

We create a People list into which we enter all of the relevant person details including name and email address. This list replaces the UIL and AD as the primary source of person information. No people picker control is used. Names are text.

This list is used as a lookup source for creating other lists. When joining in a Lookup column in this manner it is possible to also include other columns from the source list like email address. These columns are presented virtually in the new list.

I chose to keep our master list lean including only the essential people columns allowing the derived lists to augment it with additional columns if needed.

Such master people lists can be created at any level of granularity. One could be created for an entire site including its subsites. Alternately, a separate master list could be created for each subsite. It depends on what administration strategy works best for the organizational hierarchy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.