I'm trying to figure out if there is anyway to create an exclusion filter for importing expired only profiles from Active Directory through the synchronization connection for user profiles.

The accountExpires attribute will remove all profiles that has been set to expire if the operator is set to Is present. Regardless if this date has passed or not. I just want to stop importing and have SharePoint remove user profiles that expiration date has passed.

3 Answers 3


To Exclude all accounts which are either disabled, locked out, or their password has expired try:

userAccountControl Bit on equals 2 OR userAccountControl Bit on equals 5 OR userAccountControl Bit on equals 24 OR

Here is a handy reference table enter image description here

Regards, Bismarck


this is what we have, we just importing only active users

   userAccountControl   Bit on equals   2

This will only import active accounts in AD.


Try to use "userAccountControl Bit on equals 24" then.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.