I edited my connection in user profile service to filter out disabled users after that I run full sync to exclude the deleted users

Then I run the PowerShell script in this post

User Profile Inactive Profiles Not Deleting

Finally I Run mysite clean up jobs, but the user profile still shows the disabled users, am I missing something?

  • 1
    It sounds like you're using AD Import, is that correct? AD Import does not apply filters for objects that already exist in the UPSA -- MIM will, however.
    – user6024
    Nov 6, 2018 at 21:49
  • Yes, I am using AD import, is there a workaround to apply filters for objects that already exists
    – Fabio
    Nov 6, 2018 at 22:30
  • 1
    The workaround is to use Microsoft Identity Manager instead.
    – user6024
    Nov 7, 2018 at 0:27
  • We don't have MIM 🙄 recreate connection is not option!!
    – Fabio
    Nov 7, 2018 at 0:30
  • Then you need to purge the accounts by script/hand. AD Import was not the correct choice for you if you wanted this functionality.
    – user6024
    Nov 7, 2018 at 0:48

1 Answer 1


You're missing the step "Mark non-imported profiles for deletion" in these four steps:

ADI Step 1: Determine if the profile is already marked for deletion.

  • Run this SQL query against the Profile database:
  • Select * from upa.userprofile_full where bDeleted = 1

ADI Step 2: Run a Full Import.

  • "Out of Scope" (deleted, filtered, moved to a non-imported OU) users do not have their profiles automatically cleaned up by an incremental import. With AD Import, we don't use the Sync database to store "state" information about each user. As such, the only way AD Import can tell if a user has fallen "out of scope" is to import them. If the user object has not changed in AD, an incremental import will not pick them up. Luckily, AD Import is fast, so running a Full Import is not a big deal.

ADI Step 3: Mark non-imported profiles for deletion.

  • Run the following PowerShell to get a list of all your unmanaged profiles:
  • $upa = Get-spserviceapplication | ?{$_.typename -match "profile"}
  • Set-SPProfileServiceApplication $upa -GetNonImportedObjects $true | out-file c:\temp\NonImportedProfiles.txt
  • If the target profiles show up in the "NonImportedProfiles.txt" file, then you need to manually mark them for deletion with PowerShell:
  • $upa = Get-spserviceapplication | ?{$_.typename -match "profile"}
  • Set-SPProfileServiceApplication $upa -PurgeNonImportedObjects $true
  • If the target profiles are managed profiles, not marked for deletion, and you have run a Full Import, then you need to look into why AD Import is not marking them for deletion.
  • Document your connection filter and selected OUs / containers and check your target profiles against them. If you're using a complex LDAP filter on your import connection, you should consider using an LDAP tool like LDP.exe or LDAP Browser to test the LDAP filter and make sure it includes and excludes the users you think it should.

ADI Step 4: My Site Cleanup Job

  • While "Set-SPProfileServiceApplication $upa -PurgeNonImportedObjects $true" marks out-of-scope profiles for deletion, it doesn't actually delete anything. That's left to the My Site Cleanup Job.
  • Check Central Administration | Monitoring | Timer Jobs | Review Job Definitions | My Site Cleanup Job. Make sure it's set to run at least once per day.
  • Important: In SharePoint 2016, there were some major changes made to how the My Site Cleanup Job works. Instead of immediately deleting profiles that are marked for deletion, it schedules the profiles to be deleted after 30 days. The 30-day setting is hard-coded. There is no way to change it. Also, if your build is pre-August 2017 CU (16.0.4573.1002), this functionality does not work at all, even after 30 days. You'll need to upgrade. See this post for details: https://blogs.msdn.microsoft.com/spses/2017/05/22/sharepoint-2016-mysitecleanup-job-functionality-changes/

Reference: SharePoint: The complete guide to user profile cleanup – Part 4 – 2016

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.