people pickers in our intranet web application doesn't show user whose accounts are disabled in AD, but when i did people search for the user whose account is disabled i can see their profile.

after googling i found that people picker queries AD instead of UPS. what should i do to show disabled accounts in people picker.

our user profile synchronization is working normally, did not use any filters while performing the sync and also checked the property for people picker using STSADM

"stsadm.exe -o getproperty -url http://website -pn peoplepicker-searchadcustomfilter


it returned no property exists. please help me with as this is very urgent issue



You can create a custom query for Active Directory which can be used by peoplepicker to include disabled accounts in search. Below is the stsadm command for that:

stsadm -o setproperty -pn peoplepicker-searchadcustomquery -propertyvalue [your-custom-query-to-include-disabled-users]

The custom query to get only disabled accounts is :


(userAccountControl:1.2.840.113556.1.4.803:=2) is to search for users where bit 2 is enabled in the userAccountControl attribute(which means a disabled account)

The custom query to get only enabled accounts is :


You can try form a query which include both enabled and disabled users.Test it well before applying to production. :)

  • I haven't tested it, but I think to get both your filter will look like: (&(objectCategory=person)(objectClass=user)(|(userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=2))) – shufler Nov 17 '11 at 18:16

This does not work. I have tested this in production as well as in my test lab. SharePoint does not pick up disabled AD accounts in people picker

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.