people pickers in our intranet web application doesn't show user whose accounts are disabled in AD, but when i did people search for the user whose account is disabled i can see their profile.

after googling i found that people picker queries AD instead of UPS. what should i do to show disabled accounts in people picker.

our user profile synchronization is working normally, did not use any filters while performing the sync and also checked the property for people picker using STSADM

"stsadm.exe -o getproperty -url http://website -pn peoplepicker-searchadcustomfilter


it returned no property exists. please help me with as this is very urgent issue


3 Answers 3


You can create a custom query for Active Directory which can be used by peoplepicker to include disabled accounts in search. Below is the stsadm command for that:

stsadm -o setproperty -pn peoplepicker-searchadcustomquery -propertyvalue [your-custom-query-to-include-disabled-users]

The custom query to get only disabled accounts is :


(userAccountControl:1.2.840.113556.1.4.803:=2) is to search for users where bit 2 is enabled in the userAccountControl attribute(which means a disabled account)

The custom query to get only enabled accounts is :


You can try form a query which include both enabled and disabled users.Test it well before applying to production. :)

  • I haven't tested it, but I think to get both your filter will look like: (&(objectCategory=person)(objectClass=user)(|(userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=2)))
    – shufler
    Nov 17, 2011 at 18:16

This does not work. I have tested this in production as well as in my test lab. SharePoint does not pick up disabled AD accounts in people picker

$webapp = Get-SPWebApplication https://test.contoso.com
$webapp.PeoplePickerSettings.ActiveDirectoryCustomFilter = "(&(objectCategory=person)(objectClass=user)(|(userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=2)))"

This works for me to show both enabled and disabled users.

And if you need to add groups: (&(objectCategory=person)(objectClass=user)(|(userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=2))(objectCategory=group))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.