disabled user profile not deleted

Question

I edited my connection in user profile service to filter out disabled users after that I run full sync to exclude the deleted users

Then I run the PowerShell script in this post

Finally I Run mysite clean up jobs, but the user profile still shows the disabled users, am I missing something?

It sounds like you're using AD Import, is that correct? AD Import does not apply filters for objects that already exist in the UPSA -- MIM will, however. — user6024, Nov 6, 2018 at 21:49
Yes, I am using AD import, is there a workaround to apply filters for objects that already exists — Fabio, Nov 6, 2018 at 22:30
The workaround is to use Microsoft Identity Manager instead. — user6024, Nov 7, 2018 at 0:27
Then you need to purge the accounts by script/hand. AD Import was not the correct choice for you if you wanted this functionality. — user6024, Nov 7, 2018 at 0:48

Benny Skogberg · Accepted Answer · 2018-11-08 07:50:19Z

You're missing the step "Mark non-imported profiles for deletion" in these four steps:

ADI Step 1: Determine if the profile is already marked for deletion.

ADI Step 2: Run a Full Import.

"Out of Scope" (deleted, filtered, moved to a non-imported OU) users do not have their profiles automatically cleaned up by an incremental import. With AD Import, we don't use the Sync database to store "state" information about each user. As such, the only way AD Import can tell if a user has fallen "out of scope" is to import them. If the user object has not changed in AD, an incremental import will not pick them up. Luckily, AD Import is fast, so running a Full Import is not a big deal.

ADI Step 3: Mark non-imported profiles for deletion.

Run the following PowerShell to get a list of all your unmanaged profiles:
$upa = Get-spserviceapplication | ?{$_.typename -match "profile"}
Set-SPProfileServiceApplication $upa -GetNonImportedObjects $true | out-file c:\temp\NonImportedProfiles.txt
If the target profiles show up in the "NonImportedProfiles.txt" file, then you need to manually mark them for deletion with PowerShell:
$upa = Get-spserviceapplication | ?{$_.typename -match "profile"}
Set-SPProfileServiceApplication $upa -PurgeNonImportedObjects $true
If the target profiles are managed profiles, not marked for deletion, and you have run a Full Import, then you need to look into why AD Import is not marking them for deletion.
Document your connection filter and selected OUs / containers and check your target profiles against them. If you're using a complex LDAP filter on your import connection, you should consider using an LDAP tool like LDP.exe or LDAP Browser to test the LDAP filter and make sure it includes and excludes the users you think it should.

ADI Step 4: My Site Cleanup Job

While "Set-SPProfileServiceApplication $upa -PurgeNonImportedObjects $true" marks out-of-scope profiles for deletion, it doesn't actually delete anything. That's left to the My Site Cleanup Job.
Check Central Administration | Monitoring | Timer Jobs | Review Job Definitions | My Site Cleanup Job. Make sure it's set to run at least once per day.
Important: In SharePoint 2016, there were some major changes made to how the My Site Cleanup Job works. Instead of immediately deleting profiles that are marked for deletion, it schedules the profiles to be deleted after 30 days. The 30-day setting is hard-coded. There is no way to change it. Also, if your build is pre-August 2017 CU (16.0.4573.1002), this functionality does not work at all, even after 30 days. You'll need to upgrade. See this post for details: https://blogs.msdn.microsoft.com/spses/2017/05/22/sharepoint-2016-mysitecleanup-job-functionality-changes/

1 Answer 1