We have two synchronisation connections. One uses windows synchronisation and syncs an "Internal" OU group. The other uses forms authentication and syncs an "External" OU Group. This populates all the users that will access the system.


What I would like to do is stop people logging in if they don't already have a profile. E.g. They are not synced.


Take a average user, Bob. Bob is an external user and therefore we want him to use forms authentication for all scenarios. If Bob tries using windows authentication it will create a new profile which now isn't linked to any information within sharepoint. How can we stop Bob logging in using windows if he is in the external OU.

Addition Info

When we set up the forms authentication, within the provider set up, we have specified the external OU. Therefore anyone in the Internal OU actually can't log in using forms thus solving half our issue.


Managing the user policy permissions can stop people logging in which is where I started my investigation. Ideally I would like to deny permission to "all non-synced users" within the user policy for my web application. If this is possible, how can I access that group?

1 Answer 1


You have to implement security. User Profiles are not security. You can do this by granting access to your users by adding them to a group of "Approved Users" in the same way you added them to the OU for synchronization.

  • Ideally we don't want to have to manage it. However if a user does log in, they can request access. How can this be avoided as this creates a User Profile for this account?
    – Heberda
    Commented Jul 4, 2014 at 13:12
  • You have to manage security. Period. Otherwise the user profile will be created. You could go through and delete the offending profiles, but it is FAR better to take ownership of security and manage it. You are already doing that for the OU, right? Just add a step that adds the users to a Security Group. Commented Jul 4, 2014 at 16:14
  • We were attempting to manage it through the OU. If we added all users in the Internal OU to an Internal Security group could we then block forms access?
    – Heberda
    Commented Jul 16, 2014 at 10:08
  • Yes, the OU is not the same as the security group. You need the group to restrict access. Commented Jul 16, 2014 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.