What is the best practice for managing disabled users? Should these be imported in SharePoint? And if not, how to filter these records?

SharePoint 2013, Synchronization option in User Profile Service

2 Answers 2


If the users have already disabled from Active directory and you need to exclude them in SharePoint , you should do the following

  • Centeral Administration > Application Management > Mange Service Application > Manage User Profile Service .

  • Below Suncronization > Configure Syncronization Connection.

enter image description here

  • Edit Connection Filters.

enter image description here

  • At Exclusion Filter for Users > set UserAccountControl Bit on Equals 2

enter image description here

  • Now Start Full Profile Synchronization .

you can filter the Disbaled user from User Profile Sync using the Connection filter as M.Qassas Mentioned in his post.

The User Profile Synchronization timer job marks for deletion users who have been deleted from the directory source. When the My Site cleanup job runs, it looks for all users marked for deletion and deletes their profiles. Respective My Sites are then assigned to the manager for the deleted user and an e-mail message notifies the manager of this deletion. All this is handled when you have MySite Cleanup timer Job enabled.

In Most cases companies loses the mysite of disabled user due to this. In that case(if you have mysites in your company), Disabled MySite Cleanup timer Job and manually delete the User from the Profile Store, along with set the connection filter.

Check this

  • Thanks M.Qassas and Waqas! Setting "UserAccountControl Bit on Equals 2" does not work for me. Maу be because the UserAccountControl property has different values like 512, 544 or 66080. The second thing is that the OU of disabled users is not selected in sync properties, but these users are still in SP, even after full timer job.
    – blindpilot
    Sep 5, 2016 at 12:29
  • And also thanks for the link. But I run Set-SPProfileServiceApplication $upa -GetNonImportedObjects $true command it hangs for a long time with no response.
    – blindpilot
    Sep 5, 2016 at 12:32
  • So it seems to me that the only way is to manually using PowerShell remove disabled users from the profile store and then somehow try to correctly configure UPSA sync properties. Am I right?
    – blindpilot
    Sep 5, 2016 at 12:37
  • 1
    If the value is not 2 then user is not disabled in AD.check this in for values translation support.microsoft.com/en-us/kb/305144 now to stop the disabled user importing into user profile,we need to setup connection filters as mentioned after that run full profile sync followed couple of incremental sync. Script is only for deleting exiting disabled user in profile store.
    – Waqas Sarwar MVP
    Sep 5, 2016 at 12:44
  • After setting the UserAccountControl filter, then full synchronization and MySite Cleanup timer Job disabled users are still in store. So the only way for cleaning disabled users is to write powershell script. Right?
    – blindpilot
    Sep 5, 2016 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.