We have two synchronisation connections. One uses windows synchronisation and syncs an "Internal" OU group. The other uses forms authentication and syncs an "External" OU Group. This populates all the users that will access the system.
What I would like to do is stop people logging in if they don't already have a profile. E.g. They are not synced.
Take a average user, Bob. Bob is an external user and therefore we want him to use forms authentication for all scenarios. If Bob tries using windows authentication it will create a new profile which now isn't linked to any information within sharepoint. How can we stop Bob logging in using windows if he is in the external OU.
When we set up the forms authentication, within the provider set up, we have specified the external OU. Therefore anyone in the Internal OU actually can't log in using forms thus solving half our issue.
Managing the user policy permissions can stop people logging in which is where I started my investigation. Ideally I would like to deny permission to "all non-synced users" within the user policy for my web application. If this is possible, how can I access that group?