SharePoint Active Directory Import

Question

I am using SharePoint 2016 on-premise and I am also using the SharePoint Active Directory Import for user profiles. I am seeing disabled users that still show up the user profiles but according to MS "The AD import option doesn't remove users when "Filter out disabled users" is selected. This is by design..." What is the design?

Answer 1

It is expected behaviour

Since we are not using FIM for synchronization, there is nothing to look into Sync DB. Everything happens within Profile DB. Full import will detect the user is not getting imported and marks the field ‘IsImported’ to 0 on DNLookup table in Profile DB for the affected user.

If you dont want to use the Microsoft Identity Manager then follow the workaround mentioned here - Run Full Import - 2 Post that run Use SharePoint Management Shell to Run following

1. $upa = Get-SPServiceApplication -id <Identity of User Profile Service Application>
2. Set-SPProfileServiceApplication -Identity $upa – PurgeNonImportedObjects $true

Answer 2

Yes, it's by design. AD Import will not remove objects that did not fit a filter criteria but end up in the defined filter criteria (such as accounts that were disabled after their profile was imported). In order to have automatic removal based on filter criteria, you would need to implement Microsoft Identity Manager.