1

Good Day,

Note: We are not using the Profile Service, so right of the bat, that may be the issue. The reason we are not using it, is because we use HandShake to pull AD profiles for display. If setting it up will resolve my issue, please advise.

I have a PowerShell script that uses Get-SPUser, but it is returning users no longer in the site, and sometimes no longer in AD. I assume it is pulling from NT AUTHORITY\Authenticated Users.

Is there a way to flush this out without configuring the profile service, or is that the appropriate way regardless?

Just for reference, here is the part of my script that I use it:

$UserList = Get-SPUser -web $_.SiteURL -Limit ALL | Where-Object {($_.UserLogin -like "*GUEST\*") -and ($_.DisplayName -notlike "*admin*") -and ($_.DisplayName -notlike "*test*")} | Select-Object UserLogin, DisplayName, Email | ConvertTo-CSV -NoTypeInformation | Out-String

Edit:

I apologize if it was unclear. I am not sure if your answer helps me or not, as I did not quite understand what you were getting at. I am able to delete the user via /_catalogs/users/simple.aspx or /_catalogs/users/detail.aspx, but I guess I am just not understanding the front end vs hidden aspects of SharePoint's profiles. If I configure the profile sync, and accounts in AD are marked for deletion, it is my suspicion that they will still remain in the hidden list, which would not help me here. Using Get-ADUser, I would still need to know the user to check for. I just need a real cleanup

Again to clarify, here is an example. I have a site with 5 users and two user's permissions gets removed from the site. I was not the one who removed them, so they were not removed manually from the hidden user list "/_catalogs/users/simple.aspx". This results in my script still enumerating 5 users, rather than 3 users.

2 Answers 2

1

The SharePoint user list may contain users that do not exist any more in AD, see the corresponding UserInfo table in SP content DB as well. That is by design.

You can use the Get-ADUser CmdLet to check if the user exists in AD and can delete it from SP if it does not.

Assuming $userList contains your users in SP and $web is the root web of the site collection, something like this should work:

$userList | ? { ((Get-ADUser -Filter {SamAccountName -eq $_.UserLogin} -ea SilentlyContinue) -eq $Null) | % { Remove-SPUser $_ -web $web }
2
  • I apologize if it was unclear. I am not sure if your answer helps me or not, as I did not quite understand what you were getting at. I am able to delete the user via /_catalogs/users/simple.aspx or /_catalogs/users/detail.aspx, but I guess I am just not understanding the front end vs hidden aspects of SharePoint's profiles. If I configure the profile sync, and accounts in AD are marked for deletion, it is my suspicion that they will still remain in the hidden list, which would not help me here. Using Get-ADUser, I would still need to know the user to check for. I just need a real cleanup.
    – raredesign
    Feb 5, 2015 at 14:30
  • Again to clarify, here is an example. I have a site with 5 users and two user's permissions gets removed from the site. I was not the one who removed them, so they were not removed manually from the hidden user list "/_catalogs/users/simple.aspx". This results in my script still enumerating 5 users, rather than 3 users.
    – raredesign
    Feb 5, 2015 at 14:49
0

The user might have been granted direct access to a list / site. Check Site.RootWeb.SiteUsers for a full list. ( http://mstechtalk.com/sharepoint-get-list-users-using-powershell-script/)

PS, there are 3 properties with regards to users ( http://weblogs.asp.net/bsimser/440169 )

SPWeb.Users : Gets the collection of users that are explicilty added.. These users are not parts of any group they are explicitly added..

SPWeb.SiteUsers: Gets the collection of users that belong to the site collection or a group

SPWeb.AllUsers: Gets the collection of All the users. Basically, AllUsers = SiteUsers + Users

$SiteCollectionURL = http://url
$site = Get-SPSite $SiteCollectionURL
$web = $site.RootWeb
$siteUsers = $web.SiteUsers

foreach($user in $siteUsers)
{
 if($user.IsSiteAdmin -eq $true)
 {
 Write-Host "ADMIN: ", $user.LoginName
 }
 else
 {
 Write-Host "USER: ", $user.LoginName
 }
 }
 $web.Dispose()
 $site.Dispose()

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.