I'm using SharePoint 2016 On-premises server, we have two main site collection, I need to get a list of orphaned users in each site collection.

I've come across this PowerShell script mentioned here which gives me a list of all users in my site collection, which is not meeting my requirement.

I want to get the list of Orphaned users(who are not part of the active directory) from SharePoint 2016 On-prem - using PowerShell in an excel format or txt format,

Please help me with some power-shell script

  • Please look at this - sharepoint.stackexchange.com/questions/252229/…
    – Raf
    Commented Feb 13, 2020 at 4:46
  • HI @Raf, thanks for sharing the link, i want a script which i will run in my server and get a list of the orphaned users, with the list I've do some maintenance work, then i will do the clean up activity, and i dont have permission to access the Active directory or profile database Commented Feb 13, 2020 at 4:59
  • Why is the script not meeting your requirement? what is missing ? Commented Feb 13, 2020 at 5:34
  • Where does the file out file get saved? Commented May 14, 2021 at 11:58

1 Answer 1


I have used the same code, I have commented the section to remove the user, once after testing, you can uncomment the section. At line number 46, specify Your OUTPUT FILE NAME in which you will get all the Orphaned users in excel.

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue 
#Function to Check if a User exists in AD 
Function Check-UserExistsInAD() 
    Param( [Parameter(Mandatory=$true)] [string]$UserLoginID)
    Write-host $UserLoginID
    #Search the User in AD
    $Forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
    foreach ($Domain in $forest.Domains)
        $context = new-object System.DirectoryServices.ActiveDirectory.DirectoryContext("Domain", $Domain.Name)
        $domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($context)
        $root = $domain.GetDirectoryEntry()
        $search = [System.DirectoryServices.DirectorySearcher]$root
        $search.Filter = "(&(objectCategory=User)(samAccountName=$UserLoginID))"
        $result = $search.FindOne()
        if ($result -ne $null)
        return $true
        return $false
    #Get all Site Collections of the web application 
    $WebApp = Get-SPWebApplication $WebAppURL 
    #Iterate through all Site Collections 
    Foreach($site in $WebApp.Sites) 
        #Get all Webs with Unique Permissions - Which includes Root Webs
        $WebsColl = $site.AllWebs | Where {$_.HasUniqueRoleAssignments -eq $True} | ForEach-Object {
        $OrphanedUsers = @()
        #Iterate through the users collection
        ForEach($User in $_.SiteUsers)
            #Exclude Built-in User Accounts , Security Groups
            if(($User.LoginName.ToLower() -ne "nt authority\authenticated users") -and($User.LoginName.ToLower() -ne "sharepoint\system") -and($User.LoginName.ToLower() -ne "nt authority\local service") -and($user.IsDomainGroup -eq $false ) )
                $UserName = $User.LoginName.split("\") 
                $AccountName = $UserName[1] #UserName
                if ( ( Check-UserExistsInAD $AccountName) -eq $false )
                    Write-Host "$($User.Name)($($User.LoginName)) from $($_.URL)" #doesn't Exists in AD!"
                    $($User.Name);$($User.LoginName);$($_.URL) | out-file "d:OrphanedUsersRpt.txt" #Your OUTPUT FILE NAME
                    #Make a note of the Orphaned user
# **** Remove Users ****# 
# Remove the Orphaned Users from the site 
# foreach($OrpUser in $OrphanedUsers) 
# { 
# $_.SiteUsers.Remove($OrpUser) 
# Write-host "Removed the Orphaned user $($OrpUser) from $($_.URL) " 
# } 

For more information, kindly check the below links,

  1. https://www.sharepointdiary.com/2013/07/find-and-delete-orphaned-users-in-sharepoint-using-powershell.html

  2. https://www.sharepointdiary.com/2012/09/find-and-delete-orphaned-users-in-sharepoint.html

  • thanks for sharing this code, when i run this code and the other code which i mentioned , that is keep on running for a long time and displaying all the user name and its has duplicated values also Commented Feb 13, 2020 at 6:10
  • Obviously it will run for long time because it running for all the site collections in the web applications. Once you get the data in excel, you can remove the duplicate entries. You get the duplicate user values, because he might have access to site, list, files, etc. from every where it takes the user data and fills the excel/text output file Commented Feb 13, 2020 at 6:16
  • Okay, will do that, also, in the above code, the output files has only one line of date of one user, is there anything else i need to do in the code other than changing the file name Commented Feb 13, 2020 at 6:27
  • updated the code and on 3rd line, specify the $WebAppURL="YOUR WEB APPLICATION URL" Commented Feb 13, 2020 at 6:36
  • Did this work ? Commented Feb 13, 2020 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.