I have a few special accounts which are in our Active Directory "Domain Users" group, and in a specific OU - let's call it "MyAppUsers". These users do not belong to any other AD security groups.
I do not want these users to appear in my Sharepoint people picker - or anywhere else in my SharePoint for that matter.
I grant access to my SharePoint root site and all sub-sites using an "OrgStaff" AD Security group which those special accounts are NOT a part of.
I use a User Profile Synchronization service which pulls users from Active Directory.My configuration for my Active Directory connection at one time did include the OU mentioned above and so the members of "AppNameUsers" did have profiles. I've since learned that the people picker has nothing to do with Profile synchronization but I thought I'd add this for information.
I have since done two things: - removed the OU for those users from my AD connection in User Profile Service, and done a full and incremental synchronization - Deleted the users from the UIL
The user's profiles no longer exist, however they are still appearing in my people picker. Online research leads me to believe somewhere in my site the "Domain Users" group have been granted access to something or that it's because our domain org.com has been added as a security trust in Central Admin. These accounts do not have an email address. Any other tips on how to get these users out of my SharePoint people picker or to find where Domain Users have been granted access?
I've tried the recommendation here to remove specific users. I got that working but the user I deleted is not showing up so I can't use this method to remove them. Removing user from people picker/UIL
Based on a comment below I have tried to filter the individual accounts using an LDAP query like:
stsadm -o setproperty -pn peoplepicker-searchadcustomfilter -pv "(|(!sAMAccountName=firstaccount)(!sAMAccountName=secondaccount))" -url https://myrootsiteurl
I have also done the following to tell the people picker to only select from accounts in my UIL/site collection:
stsadm -o setpoperty -pn peoplepicker-onlysearchwithinsitecollection -pv yes -url https://myrootsiteurl
I have also done the following to filter out any users that do not have email addresses which these accounts do not:
stsadm -o setproperty -pn peoplepicker-searchadcustomfilter -pv "((mail=*))" -url https://myrootsiteurl
The accounts still persist in my simple 2013 people picker - while it no longer appears in my more complex people pickers that have the search icons.