I am facing a problem regarding the users' information inside the userdisp.aspx Page, not being in-sync with Active Directory.

Now we have the following settings:-

  1. SharePoint 2013 on-premises farm with enterprise edition.
  2. we did not configure any connection inside the User Profile managed service.

now the problem i am facing is as follow:-

  1. when i click on a username inside sharepoint, i got mainly 3 info about the user inside the "userdisp.aspx" Page as follow:-

    • Account
    • Name
    • Work Email. enter image description here
  2. now sometimes the Name and Work email are being out of sync with Active Directory. so i find this script which i can run on site collection basses, which will update the Work Email and Name inside SP to match AD:-

Get-SPUser –Web "http://servername/sites/WikiSite" | Set-SPUser –SyncFromAD

  1. the above script have worked well on many users, but it raised the following exception on all the users which have their Accounts values inside SP not equal to their Accounts on AD:-
Set-SPUser : Cannot get the full name or e-mail address of user "i:0#.w|ad-****\****.****".
At line:1 char:60
+ Get-SPUser –Web "http://servername/sites/WikiSite" | Set-SPUser –SyncFromA ...
+                                                            ~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (Microsoft.Share...SPCmdletSetUser:SPCmdletSetUser) [Set-SPUser],

SPException + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletSetUser

so i have concluded that the above script will base its sync on the Account values inside SP & AD. and as a result if the Account on SP & AD are not equal the script will fail to sync those users' info.

so my questions are:-

  1. is there a way i can sync the Account values between SP & AD? so before running my above script, i can sync the Users' Accounts?

  2. i noted this behavior by chance. is that i use to have a user whose Account was updated inside AD. and as a result his Account on SP was not equal his Account on AD. but when i added the user inside a sharepoint group, i noted that his Account on SP got updated to match his Account on AD.. so what is the relation between adding a user to a SP group and having his Account updated inside SP. and could i benefit from this to Sync all the users' accounts between SP and AD??

  • 1
    What you mean by update in AD? which property updated? is the SID changed? – Waqas Sarwar MVP Feb 21 '18 at 15:34
  • 1
    Well, Set-SPUser -SyncFromAD is your only method then. It's on a per-Site Collection basis, as well, so you'll have to enumerate each user on each SC. If the sAMAccountName (or whatever your login identifier is) changes, you need to use Move-SPUser. Setting up UPSA sync is about a 5 minute process. Much quicker than PoSh. – Trevor Seward Feb 21 '18 at 15:57
  • 1
    Implement UPSA sync. It will solve all of your concerns. – Trevor Seward Feb 21 '18 at 16:34
  • 1
    But you're making things significantly more complicated by attempting to re-invent the wheel. AD Import is extremely simple to set up. Get a service account, give it Replicate Directory Changes in AD at the forest root, then set up your sync connection in the UPSA. That's it. – Trevor Seward Feb 21 '18 at 16:41
  • 1
    It's best practice to create a separate account specifically for sync'ing from AD. It will not be a SharePoint Managed Account. – Trevor Seward Feb 21 '18 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.