Remove users from People Picker - find where they are granted access

Question

I have a few special accounts which are in our Active Directory "Domain Users" group, and in a specific OU - let's call it "MyAppUsers". These users do not belong to any other AD security groups.

I do not want these users to appear in my Sharepoint people picker - or anywhere else in my SharePoint for that matter.

I grant access to my SharePoint root site and all sub-sites using an "OrgStaff" AD Security group which those special accounts are NOT a part of.

I use a User Profile Synchronization service which pulls users from Active Directory.My configuration for my Active Directory connection at one time did include the OU mentioned above and so the members of "AppNameUsers" did have profiles. I've since learned that the people picker has nothing to do with Profile synchronization but I thought I'd add this for information.

I have since done two things: - removed the OU for those users from my AD connection in User Profile Service, and done a full and incremental synchronization - Deleted the users from the UIL

The user's profiles no longer exist, however they are still appearing in my people picker. Online research leads me to believe somewhere in my site the "Domain Users" group have been granted access to something or that it's because our domain org.com has been added as a security trust in Central Admin. These accounts do not have an email address. Any other tips on how to get these users out of my SharePoint people picker or to find where Domain Users have been granted access?

I've tried the recommendation here to remove specific users. I got that working but the user I deleted is not showing up so I can't use this method to remove them. Removing user from people picker/UIL

Based on a comment below I have tried to filter the individual accounts using an LDAP query like:

stsadm -o setproperty -pn peoplepicker-searchadcustomfilter -pv "(|(!sAMAccountName=firstaccount)(!sAMAccountName=secondacco‌​unt))" -url https://myrootsiteurl 

I have also done the following to tell the people picker to only select from accounts in my UIL/site collection:

stsadm -o setpoperty -pn peoplepicker-onlysearchwithinsitecollection -pv yes -url https://myrootsiteurl

I have also done the following to filter out any users that do not have email addresses which these accounts do not:

stsadm -o setproperty -pn peoplepicker-searchadcustomfilter -pv "((mail=*))" -url https://myrootsiteurl 

The accounts still persist in my simple 2013 people picker - while it no longer appears in my more complex people pickers that have the search icons.

Answer 1

PeoplePicker uses three sources to find users:

• HiddenUserList of a SiteCollection (which you already found with MemberShipGroupID=0)
• SharePoint UserProfileService (which you already cleared)
• Finally it looks directly into ActiveDirectory

I think you have to limit the last step. You have different possibilities to filter what PeoplePicker receives from AD:

• Restrict People Picker to a certain OU. Problem: This is a "whitelist". You want to exclude one OU with a "blacklist". Might not work for you
• Filter Active Directory accounts by using LDAP queries. This is most flexible but you need to get a little knowledge about LDAP-Queries.

Answer 2

I have been looking removing users from the people picker myself, recently.

I have found that I can exclude users from the people picker if they are a member of a specific Security Group (I used a Domain Local Security Group).

This is done using an LDAP filter on the Security Group:

(&(objectClass=user)(!memberOf=CN=SharePoint_Exclude,OU=Distribution Groups,OU=Groups,DC=domain,DC=co,DC=uk))

You'd want to edit the bit highlighted below:

(&(objectClass=user)(!memberOf=DISTINGUISHED NAME OF SECURITY GROUP))

The above filter is basically saying:

1. The AD Object has to be a User
2. The AD Object must NOT be a member of the specified security group

You will need to add this LDAP Filter to a PowerShell script, which needs to be ran against each Web Application you want it the filter to apply to.

$LDAPFilter = "(&(objectClass=user)(!memberOf=CN=SharePoint_Exclude,OU=Distribution Groups,OU=Groups,DC=domain,DC=co,DC=uk))"

$wa = Get-SPWebApplication "https://WEBAPPLICATION.co.uk"
$wa.PeoplePickerSettings.ActiveDirectoryCustomFilter = $LDAPFilter
$wa.Update()

Hope this helps!

Answer 3

I know this is an old post but I see I forgot to answer it. I found that whatever I did I could not get the person to disappear from the people picker. I learned that it was a problem with caching on my computer, and whomever else at any time searched and found that person in the people picker. The names were not showing up on other people's devices who had never previously looked up that person in the picker. There are threads out there about updating this in the registry, but I didn't bother.