I have created a sync connection to my AD forest, and I'm selecting very specific OU's to sync.
This means that my forest of 6'500 users is actually only synching 360 - which is exactly what I need.
The problem however, is that I do not sync user "Joe Bloggs" with the AD import. I don't want "Joe" to be able to see my site.
However, if I go to the site, and use the people picker, I can see select him if I start to type in his name.
Additionally, if I put in the "Everyone" user, he can access the site as well.
How do I go about ensuring that only the OU's I've synched are able to see the site (either as users, or via the "Everyone" option)?
The reason for this, is that we have sets of users that must not have access to the portal. They are large sets of users, so adding people manually would be time consuming.
I was hoping that a specific set of OU's, combined with "Everyone" would block them out (as they are not being synched in the first place).
I have also tried this trick to restrict the people picker
Set-SPSite -Identity "http://example.com" -UserAccountDirectoryPath "OU=UserSet,OU=Users,OU=Accounts,DC=eu,DC=foo,DC=domain,DC=COM"
This means the people picker only shows me users from Accounts > Users > UserSet.
Works perfectly, I can't add any users that I don't want - however, adding in "Eveyone" still gives "Jo Bloggs" access.
I can't fathom out how I can request that only the user profile directory is used.