0

I am trying to exclude single OU called ServiceAccounts from User profile sync in SharePoint 2016. I tried the query below but its not working, 

(|(isDeleted=TRUE)(&(objectCategory=person)(objectClass=user)
(!userAccountControl:1.2.840.113556.1.4.803:=2)(!(memberOf=OU=ServiceAccounts,OU=Centers,DC=Contoso,DC=com)))

Can some one tell me whats wrong with this? Its not excluding OU members and keep syncing all users. I tried the purge command too after each sync but no luck.

Thanks in advance!

Improve this question

3 Answers 3

Reset to default
1

Just uncheck the Organization Unit from being synchronized. That said, it is possible that the service accounts will generate a Profile regardless, depending on what they're doing.

Improve this answer
7
  • That's what I did first but did not work for some reason and I started looking in to queries. There is an option to check to exclude disabled accounts but that also does not work and I had to mentioned that in LDAP query as well as you can see. Not sure if its SP 2016 thing, not very friendly with UI ? unchecking OU only is not doing it for me.
    – Umr
    Commented Jul 27, 2017 at 15:40
  • Are all of these SharePoint service accounts; or a better way to ask, are the service accounts you're seeing in the Manage User Profiles only accounts used with SharePoint in some form or fashion?
    – user6024
    Commented Jul 27, 2017 at 15:42
  • no its showing lots more other service accounts as well for example exchange admin is also showing up , when I edit the user profile , "Distinguished Name = CN-Accname,OU=ServiceAccounts,OU=Centers,DC=Contoso,DC=com. so I believe all service accounts are in there , I want to exclude them from sync.
    – Umr
    Commented Jul 27, 2017 at 15:45
  • The proper way to do this would be to deselect the OU from the sync process then purge the service accounts from the UPSA. When using AD Import, accounts are not purged automatically under any circumstances.
    – user6024
    Commented Jul 27, 2017 at 15:46
  • I agree, that's how it should work , but not in this case.
    – Umr
    Commented Jul 27, 2017 at 15:47
1

Ok, Finally I open up a case with MS and here is solution and some more details. As mentioned by @Trevor , uncheck the OU and it will exclude users, this will work but number of users showing on the Manage Profile Page will not go down. So for example is number of user profiles on top right was 100 , you uncheck the OU , number will still show as 100. it will go up if you add new user in AD after next sync but it will not go down.

This is a known issue with MS and will be resolved in August 2017 CU, as per MS.

Issue occurs when MySiteClean up job runs. Timer Job is responsible to clean up any excluded user profiles or disabled accounts but it’s not doing it. All excluded and disabled users are stored in table called "upa.userprofilescheduledforremoval" this is new in 2016. For more details you can check out this link and how to resolve this for the time being.

Hope this will help someone struggling with the same issue.

https://blogs.msdn.microsoft.com/spses/2017/05/22/sharepoint-2016-mysitecleanup-job-functionality-changes/

Improve this answer
0

Issue resolved in August CU released today : https://support.microsoft.com/en-us/help/4011049/august-8-2017-update-for-sharepoint-server-2016-kb4011049

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.